Command and Scripting Interpreter

APT19 downloaded and launched code within a SCT file.^[4]

APT32 has used COM scriptlets to download Cobalt Strike beacons.^[5]

APT37 has used Ruby scripts to execute payloads.^[6]

APT39 has utilized AutoIt and custom scripts to perform internal reconnaissance.^[7][8]

Bandook can support commands to execute Java-based payloads.^[9]

Bonadan can create bind and reverse shells on the infected system.^[10]

CHOPSTICK is capable of performing remote command execution.^[11][12]

DarkComet can execute various types of scripts on the victim’s machine.^[13]

Donut can generate shellcode outputs that execute via Ruby.^[14]

Dragonfly has used the command line for execution.^[15]

Empire uses a command-line interface to interact with systems.^[16]

FIN5 scans processes on all victim systems in the environment and uses automated scripts to pull back the results.^[17]

FIN6 has used scripting to iterate through a list of compromised PoS systems, copy data to a log file, and remove the original data files.^[18][19]

FIN7 used SQL scripts to help perform tasks on the victim's machine.^[20][21][20]

FIVEHANDS can receive a command line argument to limit file encryption to specified directories.^[22][23]

Fox Kitten has used a Perl reverse shell to communicate with C2.^[24]

Get2 has the ability to run executables with command-line arguments.^[25]

gh0st RAT is able to open a remote shell to execute commands.^[26][27]

Imminent Monitor has a CommandPromptPacket and ScriptPacket module(s) for creating a remote shell and executing scripts.^[28]

Malware used by Ke3chang can run commands on the command-line interface.^[29][30]

Kessel can create a reverse shell between the infected host and a specified system.^[10]

Matryoshka is capable of providing Meterpreter shell access.^[31]

Melcoz has been distributed through an AutoIt loader script.^[32]

OilRig has used various types of scripting for execution.^{[33][34][35][36][37]}

For Operation Spalax, the threat actors used Nullsoft Scriptable Install System (NSIS) scripts to install malware.^[38]

P.A.S. Webshell has the ability to create reverse shells with Perl scripts.^[39]

PoetRAT has executed a Lua script through a Lua interpreter for Windows.^[40]

SpeakUp uses Perl scripts.^[41]

Stealth Falcon malware uses WMI to script data collection and command execution on the victim.^[42]

Whitefly has used a simple remote shell tool that will call back to the C2 server and wait for commands.^[43]

Windigo has used a Perl script for information gathering.^[10]

WINERACK can create a reverse shell that utilizes statically-linked Wine cmd.exe code to emulate Windows command prompt commands.^[44]

Zeus Panda can launch remote scripts on the victim’s machine.^[45]

Anti-virus can be used to automatically quarantine suspicious files.

On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent Visual Basic and JavaScript scripts from executing potentially malicious downloaded content ^[46].

Where possible, only permit execution of signed scripts.

Disable or remove any unnecessary or unused shells or interpreters.

Use application control where appropriate. For example, PowerShell Constrained Language mode can be used to restrict access to sensitive or otherwise dangerous language elements such as those used to execute arbitrary Windows APIs or files (e.g., Add-Type).^[47]

When PowerShell is necessary, consider restricting PowerShell execution policy to administrators. Be aware that there are methods of bypassing the PowerShell execution policy, depending on environment configuration.^[48]

PowerShell JEA (Just Enough Administration) may also be used to sandbox administration and limit what commands admins/users can execute through remote PowerShell sessions.^[49]

Script blocking extensions can help prevent the execution of scripts and HTA files that may commonly be used during the exploitation process. For malicious code served up through ads, adblockers can help prevent that code from executing in the first place.