{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1059","id":"T1059","name":"Command and Scripting Interpreter","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1059","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"e824af778e77fe1bda2aca662e2f2c7756837dfd2edf96051d0062c54f571a84","description":"Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of [Unix Shell](https://attack.mitre.org/techniques/T1059/004) while Windows installations include the [Windows Command Shell](https://attack.mitre.org/techniques/T1059/003) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).\n\nThere are also cross-platform interpreters such as [Python](https://attack.mitre.org/techniques/T1059/006), as well as those commonly associated with client applications such as [JavaScript](https://attack.mitre.org/techniques/T1059/007) and [Visual Basic](https://attack.mitre.org/techniques/T1059/005).\n\nAdversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in [Initial Access](https://attack.mitre.org/tactics/TA0001) payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various [Remote Services](https://attack.mitre.org/techniques/T1021) in order to achieve remote Execution.(Citation: Powershell Remote Commands)(Citation: Cisco IOS Software Integrity Assurance - Command History)(Citation: Remote Shell Execution in Python)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1059","external_id":"T1059"},{"source_name":"Remote Shell Execution in Python","description":"Abdou Rockikz. (2020, July). How to Execute Shell Commands in a Remote Machine in Python. Retrieved July 26, 2021.","url":"https://www.thepythoncode.com/article/executing-bash-commands-remotely-in-python"},{"source_name":"Cisco IOS Software Integrity Assurance - Command History","description":"Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Command History. Retrieved October 21, 2020.","url":"https://tools.cisco.com/security/center/resources/integrity_assurance.html#23"},{"source_name":"Powershell Remote Commands","description":"Microsoft. (2020, August 21). Running Remote Commands. Retrieved July 26, 2021.","url":"https://docs.microsoft.com/en-us/powershell/scripting/learn/remoting/running-remote-commands?view=powershell-7.1"}],"platforms":["Containers","ESXi","IaaS","Identity Provider","Linux","macOS","Network Devices","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","containers","identity","network-infrastructure","onprem","saas","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"},{"key":"enterprise/T1059.002","id":"T1059.002","name":"AppleScript","page":"techniques/enterprise/T1059.002/"},{"key":"enterprise/T1059.003","id":"T1059.003","name":"Windows Command Shell","page":"techniques/enterprise/T1059.003/"},{"key":"enterprise/T1059.004","id":"T1059.004","name":"Unix Shell","page":"techniques/enterprise/T1059.004/"},{"key":"enterprise/T1059.005","id":"T1059.005","name":"Visual Basic","page":"techniques/enterprise/T1059.005/"},{"key":"enterprise/T1059.006","id":"T1059.006","name":"Python","page":"techniques/enterprise/T1059.006/"},{"key":"enterprise/T1059.007","id":"T1059.007","name":"JavaScript","page":"techniques/enterprise/T1059.007/"},{"key":"enterprise/T1059.008","id":"T1059.008","name":"Network Device CLI","page":"techniques/enterprise/T1059.008/"},{"key":"enterprise/T1059.009","id":"T1059.009","name":"Cloud API","page":"techniques/enterprise/T1059.009/"},{"key":"enterprise/T1059.010","id":"T1059.010","name":"AutoHotKey & AutoIT","page":"techniques/enterprise/T1059.010/"},{"key":"enterprise/T1059.011","id":"T1059.011","name":"Lua","page":"techniques/enterprise/T1059.011/"},{"key":"enterprise/T1059.012","id":"T1059.012","name":"Hypervisor CLI","page":"techniques/enterprise/T1059.012/"},{"key":"enterprise/T1059.013","id":"T1059.013","name":"Container CLI/API","page":"techniques/enterprise/T1059.013/"}],"telemetry":[{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0002","name":"User Account Authentication","page":"telemetry/DC0002/","kind":"attack_component","category":"Identity and SaaS","description":"Authentication attempts and outcomes for a user or workload account.","collection_focus":"Collect successful and failed sign-ins, authentication method, application and conditional-access context; distinguish account validation from session creation.","providers":[{"name":"Microsoft Entra sign-in logs","scope":"Interactive, non-interactive and workload sign-in contexts, subject to tenant features and access.","source_id":"entra"},{"name":"Cloud identity service audit","scope":"Issuer-side credential and administrative events where the service supports them.","source_id":"cloudtrail"},{"name":"Application audit instrumentation","scope":"Application-side use of identities and sessions; design fields without raw tokens.","source_id":"otel"}],"configuration":["Enable/export the required identity sign-in and audit categories from the lab tenant to a protected destination. Document license, role and retention requirements.","Correlate issuance or administrative changes with later sign-ins using non-secret credential IDs, application IDs, user IDs and correlation IDs.","Exclude passwords, bearer tokens, cookies and private keys. Record success, failure, authentication context and application result separately."],"configuration_example":null,"required_fields":["account","application","result","reason","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0002","collector":"illustrative-lab-collector","observation":{"account":"analyst@example.test","application":"lab-portal","result":"failure","reason":"invalid_credential","source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A token creation record is not evidence of token use; a sign-in is not a complete record of every resource access. Some provider-side data is unavailable to the customer.","sources":[{"id":"entra","title":"Microsoft Entra sign-in logs","url":"https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins"},{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per identity and application: first-seen clients/resources, changes in authentication failures and session patterns, and unusual permission changes. Separate automation, travel, shared egress and identity-provider policy changes."}],"detection":{"key":"enterprise/T1059","id":"T1059","name":"Command and Scripting Interpreter","domain":"enterprise","platforms":["Containers","ESXi","IaaS","Identity Provider","Linux","macOS","Network Devices","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","containers","identity","network-infrastructure","onprem","saas","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1059","technique_page":"techniques/enterprise/T1059/","page":"detections/enterprise/T1059/","status":"rule_source_available","counts":{"sigma":75,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":5,"live_validated":0},"sigma_rules":[{"id":"72af37e2-ec32-47dc-992b-bc288a2708cb","title":"Azure New CloudShell Created","status":"test","level":"medium","logsource":{"product":"azure","service":"activitylogs"},"data_path":"data/detection-rules/72af37e2-ec32-47dc-992b-bc288a2708cb.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/activity_logs/azure_new_cloudshell_created.yml","author":"Austin Songer","kind":"sigma"},{"id":"808146b2-9332-4d78-9416-d7e47012d83d","title":"BPFDoor Abnormal Process ID or Lock File Accessed","status":"test","level":"high","logsource":{"product":"linux","service":"auditd"},"data_path":"data/detection-rules/808146b2-9332-4d78-9416-d7e47012d83d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/path/lnx_auditd_bpfdoor_file_accessed.yml","author":"Rafal Piasecki","kind":"sigma"},{"id":"8c1a5675-cb85-452f-a298-b01b22a51856","title":"Suspicious Invocation of Shell via AWK - Linux","status":"test","level":"high","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/8c1a5675-cb85-452f-a298-b01b22a51856.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_awk_shell_spawn.yml","author":"Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)","kind":"sigma"},{"id":"db1ac3be-f606-4e3a-89e0-9607cbe6b98a","title":"Capsh Shell Invocation - Linux","status":"test","level":"high","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/db1ac3be-f606-4e3a-89e0-9607cbe6b98a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_capsh_shell_invocation.yml","author":"Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)","kind":"sigma"},{"id":"47b3bbd4-1bf7-48cc-84ab-995362aaa75a","title":"Shell Execution via Git - Linux","status":"test","level":"high","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/47b3bbd4-1bf7-48cc-84ab-995362aaa75a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_git_shell_execution.yml","author":"Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)","kind":"sigma"},{"id":"7f734ed0-4f47-46c0-837f-6ee62505abd9","title":"Potential Netcat Reverse Shell Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/7f734ed0-4f47-46c0-837f-6ee62505abd9.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_netcat_reverse_shell.yml","author":"@d4ns4n_, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"c4042d54-110d-45dd-a0e1-05c47822c937","title":"Python Spawning Pretty TTY Via PTY Module","status":"test","level":"medium","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/c4042d54-110d-45dd-a0e1-05c47822c937.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_python_pty_spawn.yml","author":"Nextron Systems","kind":"sigma"},{"id":"2d2f44ff-4611-4778-a8fc-323a0e9850cc","title":"Inline Python Execution - Spawn Shell Via OS System Library","status":"test","level":"high","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/2d2f44ff-4611-4778-a8fc-323a0e9850cc.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_python_shell_os_system.yml","author":"Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)","kind":"sigma"},{"id":"e2326866-609f-4015-aea9-7ec634e8aa04","title":"Shell Execution via Rsync - Linux","status":"experimental","level":"high","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/e2326866-609f-4015-aea9-7ec634e8aa04.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_rsync_shell_execution.yml","author":"Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Florian Roth","kind":"sigma"},{"id":"297241f3-8108-4b3a-8c15-2dda9f844594","title":"Suspicious Invocation of Shell via Rsync","status":"experimental","level":"high","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/297241f3-8108-4b3a-8c15-2dda9f844594.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_rsync_shell_spawn.yml","author":"Florian Roth","kind":"sigma"},{"id":"8737b7f6-8df3-4bb7-b1da-06019b99b687","title":"Shell Invocation Via Ssh - Linux","status":"test","level":"high","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/8737b7f6-8df3-4bb7-b1da-06019b99b687.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_ssh_shell_execution.yml","author":"Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)","kind":"sigma"},{"id":"d292e0af-9a18-420c-9525-ec0ac3936892","title":"Suspicious Java Children Processes","status":"test","level":"high","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/d292e0af-9a18-420c-9525-ec0ac3936892.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_susp_java_children.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"7ab8f73a-fcff-428b-84aa-6a5ff7877dea","title":"Vim GTFOBin Abuse - Linux","status":"test","level":"high","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/7ab8f73a-fcff-428b-84aa-6a5ff7877dea.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_vim_shell_execution.yml","author":"Nasreddine Bencherchali (Nextron Systems), Luc Génaux","kind":"sigma"},{"id":"4e25af4b-246d-44ea-8563-e42aacab006b","title":"Potential Xterm Reverse Shell","status":"test","level":"medium","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/4e25af4b-246d-44ea-8563-e42aacab006b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_xterm_reverse_shell.yml","author":"@d4ns4n_","kind":"sigma"},{"id":"e0cfaecd-602d-41af-988d-f6ccebb2af26","title":"Suspicious Installer Package Child Process","status":"test","level":"medium","logsource":{"category":"process_creation","product":"macos"},"data_path":"data/detection-rules/e0cfaecd-602d-41af-988d-f6ccebb2af26.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_installer_susp_child_process.yml","author":"Sohan G (D4rkCiph3r)","kind":"sigma"},{"id":"234dc5df-40b5-49d1-bf53-0d44ce778eca","title":"Payload Decoded and Decrypted via Built-in Utilities","status":"test","level":"medium","logsource":{"category":"process_creation","product":"macos"},"data_path":"data/detection-rules/234dc5df-40b5-49d1-bf53-0d44ce778eca.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_payload_decoded_and_decrypted.yml","author":"Tim Rauch (rule), Elastic (idea)","kind":"sigma"},{"id":"0250638a-2b28-4541-86fc-ea4c558fa0c6","title":"Suspicious Browser Child Process - MacOS","status":"test","level":"medium","logsource":{"category":"process_creation","product":"macos"},"data_path":"data/detection-rules/0250638a-2b28-4541-86fc-ea4c558fa0c6.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_susp_browser_child_process.yml","author":"Sohan G (D4rkCiph3r)","kind":"sigma"},{"id":"6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4","title":"Suspicious Execution via macOS Script Editor","status":"test","level":"medium","logsource":{"category":"process_creation","product":"macos"},"data_path":"data/detection-rules/6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_susp_execution_macos_script_editor.yml","author":"Tim Rauch (rule), Elastic (idea)","kind":"sigma"},{"id":"24549159-ac1b-479c-8175-d42aea947cae","title":"Hacktool Ruler","status":"test","level":"high","logsource":{"product":"windows","service":"security"},"data_path":"data/detection-rules/24549159-ac1b-479c-8175-d42aea947cae.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_alert_ruler.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"ea9bf0fa-edec-4fb8-8b78-b119f2528186","title":"Windows Defender AMSI Trigger Detected","status":"stable","level":"high","logsource":{"product":"windows","service":"windefend"},"data_path":"data/detection-rules/ea9bf0fa-edec-4fb8-8b78-b119f2528186.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/windefend/win_defender_malware_detected_amsi_source.yml","author":"Bhabesh Raj","kind":"sigma"},{"id":"57b649ef-ff42-4fb0-8bf6-62da243a1708","title":"Windows Defender Threat Detected","status":"stable","level":"high","logsource":{"product":"windows","service":"windefend"},"data_path":"data/detection-rules/57b649ef-ff42-4fb0-8bf6-62da243a1708.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/windefend/win_defender_threat.yml","author":"Ján Trenčanský","kind":"sigma"},{"id":"6e90ae7a-7cd3-473f-a035-4ebb72d961da","title":"PCRE.NET Package Temp Files","status":"test","level":"high","logsource":{"category":"file_event","product":"windows"},"data_path":"data/detection-rules/6e90ae7a-7cd3-473f-a035-4ebb72d961da.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_pcre_net_temp_file.yml","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","kind":"sigma"},{"id":"bbb7e38c-0b41-4a11-b306-d2a457b7ac2b","title":"Suspicious File Created In PerfLogs","status":"test","level":"medium","logsource":{"category":"file_event","product":"windows"},"data_path":"data/detection-rules/bbb7e38c-0b41-4a11-b306-d2a457b7ac2b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_perflogs_susp_files.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"1277f594-a7d1-4f28-a2d3-73af5cbeab43","title":"Windows Shell/Scripting Application File Write to Suspicious Folder","status":"test","level":"high","logsource":{"category":"file_event","product":"windows"},"data_path":"data/detection-rules/1277f594-a7d1-4f28-a2d3-73af5cbeab43.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_shell_write_susp_directory.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"fb4e2211-6d08-426b-8e6f-0d4a161e3b1d","title":"Clfs.SYS Loaded By Process Located In a Potential Suspicious Location","status":"experimental","level":"medium","logsource":{"category":"image_load","product":"windows"},"data_path":"data/detection-rules/fb4e2211-6d08-426b-8e6f-0d4a161e3b1d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_clfs_load.yml","author":"X__Junior","kind":"sigma"},{"id":"84b0a8f3-680b-4096-a45b-e9a89221727c","title":"PCRE.NET Package Image Load","status":"test","level":"high","logsource":{"category":"image_load","product":"windows"},"data_path":"data/detection-rules/84b0a8f3-680b-4096-a45b-e9a89221727c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_dll_pcre_dotnet_dll_load.yml","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","kind":"sigma"},{"id":"799a5f48-0ac1-4e0f-9152-71d137d48c2a","title":"Abusable DLL Potential Sideloading From Suspicious Location","status":"test","level":"high","logsource":{"category":"image_load","product":"windows"},"data_path":"data/detection-rules/799a5f48-0ac1-4e0f-9152-71d137d48c2a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_side_load_abused_dlls_susp_paths.yml","author":"X__Junior (Nextron Systems)","kind":"sigma"},{"id":"c1344fa2-323b-4d2e-9176-84b4d4821c88","title":"Windows Defender Exclusions Added - PowerShell","status":"test","level":"medium","logsource":{"category":"ps_script","product":"windows","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/c1344fa2-323b-4d2e-9176-84b4d4821c88.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_win_defender_exclusions_added.yml","author":"Tim Rauch, Elastic (idea)","kind":"sigma"},{"id":"8e95e73e-ba02-4a87-b4d7-0929b8053038","title":"Suspicious ArcSOC.exe Child Process","status":"experimental","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/8e95e73e-ba02-4a87-b4d7-0929b8053038.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_arcsoc_susp_child_process.yml","author":"Micah Babinski","kind":"sigma"},{"id":"a77c1610-fc73-4019-8e29-0f51efc04a51","title":"Potential Dosfuscation Activity","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/a77c1610-fc73-4019-8e29-0f51efc04a51.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_cmd_dosfuscation.yml","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"4b991083-3d0e-44ce-8fc4-b254025d8d4b","title":"Unusual Parent Process For Cmd.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/4b991083-3d0e-44ce-8fc4-b254025d8d4b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_cmd_unusual_parent.yml","author":"Tim Rauch, Elastic (idea)","kind":"sigma"},{"id":"cbb9e3d1-2386-4e59-912e-62f1484f7a89","title":"Conhost Spawned By Uncommon Parent Process","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/cbb9e3d1-2386-4e59-912e-62f1484f7a89.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_conhost_uncommon_parent.yml","author":"Tim Rauch, Elastic (idea)","kind":"sigma"},{"id":"d87100fd-60cc-4899-a5d0-10423873eb1d","title":"Deno Runtime Spawns Shell Or Scripting Interpreter","status":"experimental","level":"medium","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/d87100fd-60cc-4899-a5d0-10423873eb1d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_deno_susp_child_process.yml","author":"Andrey Pautov","kind":"sigma"},{"id":"9aa5106d-bce3-4b13-86df-3a20f1d5cf0b","title":"Forfiles Command Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/9aa5106d-bce3-4b13-86df-3a20f1d5cf0b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_forfiles_proxy_execution_.yml","author":"Tim Rauch, Elastic, E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community","kind":"sigma"},{"id":"b96b2031-7c17-4473-afe7-a30ce714db29","title":"Use of FSharp Interpreters","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/b96b2031-7c17-4473-afe7-a30ce714db29.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_fsi_fsharp_code_execution.yml","author":"Christopher Peacock @SecurePeacock, SCYTHE @scythe_io","kind":"sigma"},{"id":"c0b2768a-dd06-4671-8339-b16ca8d1f27f","title":"Potentially Suspicious NTFS Symlink Behavior Modification","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/c0b2768a-dd06-4671-8339-b16ca8d1f27f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_fsutil_symlinkevaluation.yml","author":"frack113, The DFIR Report","kind":"sigma"},{"id":"06b401f4-107c-4ff9-947f-9ec1e7649f1e","title":"Potential Arbitrary Command Execution Via FTP.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/06b401f4-107c-4ff9-947f-9ec1e7649f1e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_ftp_arbitrary_command_execution.yml","author":"Victor Sergeev, oscd.community","kind":"sigma"},{"id":"f35c5d71-b489-4e22-a115-f003df287317","title":"Potential CobaltStrike Process Patterns","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/f35c5d71-b489-4e22-a115-f003df287317.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_cobaltstrike_process_patterns.yml","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"42333b2c-b425-441c-b70e-99404a17170f","title":"HackTool - Sliver C2 Implant Activity Pattern","status":"test","level":"critical","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/42333b2c-b425-441c-b70e-99404a17170f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_sliver_c2_execution_pattern.yml","author":"Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"7a4d9232-92fc-404d-8ce1-4c92e7caf539","title":"HackTool - Stracciatella Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/7a4d9232-92fc-404d-8ce1-4c92e7caf539.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_stracciatella_execution.yml","author":"pH-T (Nextron Systems)","kind":"sigma"},{"id":"814c95cc-8192-4378-a70a-f1aafd877af1","title":"Use of OpenConsole","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/814c95cc-8192-4378-a70a-f1aafd877af1.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_lolbin_openconsole.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2","title":"Use of Pcalua For Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_lolbin_pcalua.yml","author":"Nasreddine Bencherchali (Nextron Systems), E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community","kind":"sigma"},{"id":"eca49c87-8a75-4f13-9c73-a5a29e845f03","title":"Suspicious Runscripthelper.exe","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/eca49c87-8a75-4f13-9c73-a5a29e845f03.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_lolbin_runscripthelper.yml","author":"Victor Sergeev, oscd.community","kind":"sigma"},{"id":"2c28c248-7f50-417a-9186-a85b223010ee","title":"Wscript Shell Run In CommandLine","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/2c28c248-7f50-417a-9186-a85b223010ee.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_mshta_inline_vbscript.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"55f0a3a1-846e-40eb-8273-677371b8d912","title":"Outlook EnableUnsafeClientMailRules Setting Enabled","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/55f0a3a1-846e-40eb-8273-677371b8d912.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_office_outlook_enable_unsafe_client_mail_rules.yml","author":"Markus Neis, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"e212d415-0e93-435f-9e1a-f29005bb4723","title":"Suspicious Remote Child Process From Outlook","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/e212d415-0e93-435f-9e1a-f29005bb4723.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_office_outlook_susp_child_processes_remote.yml","author":"Markus Neis, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"f426547a-e0f7-441a-b63e-854ac5bdf54d","title":"Perl Inline Command Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/f426547a-e0f7-441a-b63e-854ac5bdf54d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_perl_inline_command_execution.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"d81871ef-5738-47ab-9797-7a9c90cd4bfb","title":"Php Inline Command Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/d81871ef-5738-47ab-9797-7a9c90cd4bfb.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_php_inline_command_execution.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"85b0b087-eddf-4a2b-b033-d771fa2b9775","title":"PowerShell Download and Execution Cradles","status":"test","level":"high","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/85b0b087-eddf-4a2b-b033-d771fa2b9775.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_download_iex.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"c83bf4b5-cdf0-437c-90fa-43d734f7c476","title":"Run PowerShell Script from Redirected Input Stream","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/c83bf4b5-cdf0-437c-90fa-43d734f7c476.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_run_script_from_input_stream.yml","author":"Moriarty Meng (idea), Anton Kutepov (rule), oscd.community","kind":"sigma"},{"id":"bdeeabc9-ff2a-4a51-be59-bb253aac7891","title":"PUA - Wsudo Suspicious Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/bdeeabc9-ff2a-4a51-be59-bb253aac7891.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_wsudo_susp_execution.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"899133d5-4d7c-4a7f-94ee-27355c879d90","title":"Python Inline Command Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/899133d5-4d7c-4a7f-94ee-27355c879d90.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_python_inline_command_execution.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"480e7e51-e797-47e3-8d72-ebfce65b6d8d","title":"Python Spawning Pretty TTY on Windows","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/480e7e51-e797-47e3-8d72-ebfce65b6d8d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_python_pty_spawn.yml","author":"Nextron Systems","kind":"sigma"},{"id":"afe52666-401e-4a02-b4ff-5d128990b8cb","title":"Suspicious Greedy Compression Using Rar.EXE","status":"test","level":"high","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/afe52666-401e-4a02-b4ff-5d128990b8cb.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_rar_susp_greedy_compression.yml","author":"X__Junior (Nextron Systems), Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"6bba49bf-7f8c-47d6-a1bb-6b4dece4640e","title":"Suspicious RASdial Activity","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/6bba49bf-7f8c-47d6-a1bb-6b4dece4640e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_rasdial_execution.yml","author":"juju4","kind":"sigma"},{"id":"7530cd3d-7671-43e3-b209-976966f6ea48","title":"Renamed CURL.EXE Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/7530cd3d-7671-43e3-b209-976966f6ea48.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_renamed_curl.yml","author":"X__Junior (Nextron Systems)","kind":"sigma"},{"id":"277a4393-446c-449a-b0ed-7fdc7795244c","title":"Renamed FTP.EXE Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/277a4393-446c-449a-b0ed-7fdc7795244c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_renamed_ftp.yml","author":"Victor Sergeev, oscd.community","kind":"sigma"},{"id":"264982dc-dbad-4dce-b707-1e0d3e0f73d9","title":"Renamed NirCmd.EXE Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/264982dc-dbad-4dce-b707-1e0d3e0f73d9.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_renamed_nircmd.yml","author":"X__Junior (Nextron Systems)","kind":"sigma"},{"id":"2433a154-bb3d-42e4-86c3-a26bdac91c45","title":"Renamed PingCastle Binary Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/2433a154-bb3d-42e4-86c3-a26bdac91c45.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_renamed_pingcastle.yml","author":"Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)","kind":"sigma"},{"id":"20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8","title":"Ruby Inline Command Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_ruby_inline_command_execution.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"178e615d-e666-498b-9630-9ed363038101","title":"Elevated System Shell Spawned From Uncommon Parent Location","status":"test","level":"medium","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/178e615d-e666-498b-9630-9ed363038101.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_elevated_system_shell_uncommon_parent.yml","author":"frack113, Tim Shelton (update fp)","kind":"sigma"},{"id":"69bd9b97-2be2-41b6-9816-fb08757a4d1a","title":"Potentially Suspicious Execution From Parent Process In Public Folder","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/69bd9b97-2be2-41b6-9816-fb08757a4d1a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_execution_from_public_folder_as_parent.yml","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"ae9b0bd7-8888-4606-b444-0ed7410cb728","title":"Writing Of Malicious Files To The Fonts Folder","status":"test","level":"medium","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/ae9b0bd7-8888-4606-b444-0ed7410cb728.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_hiding_malware_in_fonts_folder.yml","author":"Sreeman","kind":"sigma"},{"id":"f8ad2e2c-40b6-4117-84d7-20b89896ab23","title":"Suspicious Scan Loop Network","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/f8ad2e2c-40b6-4117-84d7-20b89896ab23.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_network_scan_loop.yml","author":"frack113","kind":"sigma"},{"id":"efdd8dd5-cee8-4e59-9390-7d4d5e4dd6f6","title":"Suspicious Program Names","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/efdd8dd5-cee8-4e59-9390-7d4d5e4dd6f6.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_progname.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"1228c958-e64e-4e71-92ad-7d429f4138ba","title":"Script Interpreter Execution From Suspicious Folder","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/1228c958-e64e-4e71-92ad-7d429f4138ba.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_script_exec_from_env_folder.yml","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e","title":"Sysprep on AppData Folder","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_sysprep_appdata.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"7aa4e81a-a65c-4e10-9f81-b200eb229d7d","title":"Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/7aa4e81a-a65c-4e10-9f81-b200eb229d7d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_vmware_toolbox_cmd_persistence.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"236d8e89-ed95-4789-a982-36f4643738ba","title":"Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/236d8e89-ed95-4789-a982-36f4643738ba.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_vmware_toolbox_cmd_persistence_susp.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"5687f942-867b-4578-ade7-1e341c46e99a","title":"VMToolsd Suspicious Child Process","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/5687f942-867b-4578-ade7-1e341c46e99a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_vmware_vmtoolsd_susp_child_process.yml","author":"bohops, Bhabesh Raj","kind":"sigma"},{"id":"05ebafc8-7aa2-4bcd-a269-2aec93f9e842","title":"Add New Download Source To Winget","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/05ebafc8-7aa2-4bcd-a269-2aec93f9e842.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_winget_add_custom_source.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2","title":"Add Insecure Download Source To Winget","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_winget_add_insecure_custom_source.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"c15a46a0-07d4-4c87-b4b6-89207835a83b","title":"Add Potential Suspicious New Download Source To Winget","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/c15a46a0-07d4-4c87-b4b6-89207835a83b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_winget_add_susp_custom_source.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"313d6012-51a0-4d93-8dfc-de8553239e25","title":"Install New Package Via Winget Local Manifest","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/313d6012-51a0-4d93-8dfc-de8553239e25.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_winget_local_install_via_manifest.yml","author":"Sreeman, Florian Roth (Nextron Systems), frack113","kind":"sigma"},{"id":"eca8ae39-5c3c-4321-b538-9e64fe25822e","title":"Installation of WSL Kali-Linux","status":"experimental","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/eca8ae39-5c3c-4321-b538-9e64fe25822e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wsl_kali_linux_installation.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1059-1","technique_id":"T1059","title":"T1059 Command and Scripting Interpreter","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#execution","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":54,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L54","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"3085f5f5c095707f7dfa27dbd3d7882f1d6a1796c21d813aab297b1f3e7d1905","validation":"published_concept_not_executable_or_live_validated","logic":"MATCH(process_name IN command_interpreters) AND command_line MATCHES suspicious_argument_patterns -> ALERT","log_sources":[{"title":"Process Execution Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#6-process-execution-logs"},{"title":"Command-Line and Shell History Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#7-command-line-and-shell-history-logs"},{"title":"Script-Execution Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#8-script-execution-logs"}]}],"atlas_anomaly":[{"id":"atlas-anomaly-t1059-1","technique_id":"T1059","title":"Command or scripting interpreter execution — T1059 Command and Scripting Interpreter","kind":"anomaly","source_url":"https://1200km.com/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#command-interpreter-execution","source_path":"docs/attack-statistical-anomaly-mapping.md","source_line":43,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-statistical-anomaly-mapping.md#L43","source_file_sha256":"9d38eaa6306863918e8193f267fb063270260e50b013928dc97893d5e74bf144","source_row_sha256":"e0e7d2734dca0d0875e734682a1105e5a2c472ec4c141b2bf0c889cf25ed31d0","validation":"published_concept_not_executable_or_live_validated","comparison_unit":"user, host, and process lineage.","expected_behavior":"interpreters are launched by recurring parents with familiar arguments.","deviation":"rare parent-interpreter edge, first-seen argument pattern, or unusual execution rate.","anomaly_types":[{"title":"Self-Baseline Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#7-self-baseline-anomaly"},{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Rare-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#84-rare-category-anomaly"}],"log_sources":[{"title":"Process Execution Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#6-process-execution-logs"},{"title":"Script-Execution Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#8-script-execution-logs"}],"context_references":[{"title":"Volt Typhoon joint advisory — downloaded copy","url":"https://1200km.com/anomaly-detection-atlas/reports/cti-ir/fbi-aa24-038a-volt-typhoon.pdf"},{"title":"original source","url":"https://www.fbi.gov/file-repository/cyber-alerts/prc-state-sponsored-actors-compromise-and-maintain-persistent-access-to-u-s-critical-infrastructure.pdf"}]}],"anomaly_types":[{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Rare-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#84-rare-category-anomaly"},{"title":"Self-Baseline Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#7-self-baseline-anomaly"}],"strategies":[{"id":"DET0516","name":"Behavioral Detection of Command and Scripting Interpreter Abuse","url":"https://attack.mitre.org/detectionstrategies/DET0516","stix_id":"x-mitre-detection-strategy--8582f5e6-44a5-4950-b7e8-a3e1b6d58d63","relationship_id":"relationship--51b6dafa-da43-4f59-aea4-30caa3a10005","description":"","analytics":[{"id":"AN1428","name":"Analytic 1428","guidance":"Detects the execution of scripting or command interpreters (e.g., powershell.exe, cmd.exe, wscript.exe) outside expected administrative time windows or from abnormal user contexts, often followed by encoded/obfuscated arguments or secondary execution events.","url":"https://attack.mitre.org/detectionstrategies/DET0516#AN1428","platforms":["Windows"],"tuning":[{"field":"CommandLinePattern","description":"Tunable to match encoded or uncommon script execution patterns specific to the environment."},{"field":"ParentProcessName","description":"May vary across managed/unmanaged workstations or user-driven script activity."},{"field":"TimeWindow","description":"Used to restrict analysis to work hours or known admin maintenance windows."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN1428","source_url":"https://attack.mitre.org/detectionstrategies/DET0516#AN1428","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN1429","name":"Analytic 1429","guidance":"Detects use of shell interpreters (e.g., bash, sh, python, perl) initiated by users or processes not normally executing them, especially when chaining suspicious utilities like netcat, curl, or ssh.","url":"https://attack.mitre.org/detectionstrategies/DET0516#AN1429","platforms":["Linux"],"tuning":[{"field":"InterpreterName","description":"Regex to identify which interpreters (bash, python, ruby) to monitor based on typical usage."},{"field":"UserContext","description":"Scope to users or service accounts not expected to run interpreters interactively."},{"field":"ExecutionChainLength","description":"Defines maximum process tree depth to correlate interpreter execution with its effects."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve","platforms":["Linux"],"analytic_id":"AN1429","source_url":"https://attack.mitre.org/detectionstrategies/DET0516#AN1429","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN1430","name":"Analytic 1430","guidance":"Detects launch of command-line interpreters via Terminal, Automator, or hidden `osascript`, especially when parent process lineage deviates from user-initiated applications.","url":"https://attack.mitre.org/detectionstrategies/DET0516#AN1430","platforms":["macOS"],"tuning":[{"field":"LaunchAgentName","description":"Monitor for specific plist agents frequently abused for persistence or payload execution."},{"field":"ScriptName","description":"Path or script name pattern (e.g., hidden files, /tmp locations)."},{"field":"TerminalAppUsage","description":"Adjust based on whether Terminal.app use is common or restricted in user policy."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"log stream --info --predicate 'eventMessage CONTAINS \"exec\"'","platforms":["macOS"],"analytic_id":"AN1430","source_url":"https://attack.mitre.org/detectionstrategies/DET0516#AN1430","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN1431","name":"Analytic 1431","guidance":"Detects use of 'esxcli system' or direct interpreter commands (e.g., busybox shell) invoked from SSH or host terminal unexpectedly.","url":"https://attack.mitre.org/detectionstrategies/DET0516#AN1431","platforms":["ESXi"],"tuning":[{"field":"ShellEnabledFlag","description":"Control alerting based on whether ESXi shell access is typically disabled."},{"field":"SSHContext","description":"Scope detection to SSH session origins or internal vs. remote access."}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"esxi:vobd","channel":"shell session start","platforms":["ESXi"],"analytic_id":"AN1431","source_url":"https://attack.mitre.org/detectionstrategies/DET0516#AN1431","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]},{"id":"AN1432","name":"Analytic 1432","guidance":"Identifies CLI interpreter access (e.g., Cisco IOS, Juniper JUNOS) via `enable` mode or scripting-capable sessions used by uncommon accounts or from unknown IPs.","url":"https://attack.mitre.org/detectionstrategies/DET0516#AN1432","platforms":["Network Devices"],"tuning":[{"field":"UserRole","description":"Which roles or privilege levels should be monitored for interpreter misuse."},{"field":"DeviceType","description":"Support filtering for routers, switches, firewalls depending on network segmentation."}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"networkdevice:cli","channel":"shell command","platforms":["Network Devices"],"analytic_id":"AN1432","source_url":"https://attack.mitre.org/detectionstrategies/DET0516#AN1432","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0002","component":"User Account Authentication","name":"networkdevice:syslog","channel":"authentication & authorization","platforms":["Network Devices"],"analytic_id":"AN1432","source_url":"https://attack.mitre.org/detectionstrategies/DET0516#AN1432","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0002/"}]}]}],"telemetry_references":[{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0002","name":"User Account Authentication","tag":"User Account Authentication","page":"telemetry/DC0002/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0695","name":"Donut","page":"tools/S0695/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0363","name":"Empire","page":"tools/S0363/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0434","name":"Imminent Monitor","page":"tools/S0434/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0695","name":"Donut","page":"tools/S0695/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0363","name":"Empire","page":"tools/S0363/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0434","name":"Imminent Monitor","page":"tools/S0434/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0023","name":"CHOPSTICK","url":"https://attack.mitre.org/software/S0023","kind":"malware","description":"[CHOPSTICK](https://attack.mitre.org/software/S0023) is capable of performing remote command execution.(Citation: Crowdstrike DNC June 2016)(Citation: ESET Sednit Part 2)","relationship_id":"relationship--2fa20fad-4ede-42f4-8ce5-7f5a6ce83ed8","references":[{"source_name":"Crowdstrike DNC June 2016","description":"Alperovitch, D.. (2016, June 15). Bears in the Midst: Intrusion into the Democratic National Committee. Retrieved August 3, 2016.","url":"https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"},{"source_name":"ESET Sednit Part 2","description":"ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.","url":"http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf"}]},{"id":"S0032","name":"gh0st RAT","url":"https://attack.mitre.org/software/S0032","kind":"malware","description":"[gh0st RAT](https://attack.mitre.org/software/S0032) is able to open a remote shell to execute commands.(Citation: FireEye Hacking Team)(Citation: Nccgroup Gh0st April 2018)","relationship_id":"relationship--68852bf2-c3cf-4d59-b1c1-f6af8fb61be6","references":[{"source_name":"FireEye Hacking Team","description":"FireEye Threat Intelligence. (2015, July 13). Demonstrating Hustle, Chinese APT Groups Quickly Use Zero-Day Vulnerability (CVE-2015-5119) Following Hacking Team Leak. Retrieved January 25, 2016.","url":"https://www.fireeye.com/blog/threat-research/2015/07/demonstrating_hustle.html"},{"source_name":"Nccgroup Gh0st April 2018","description":"Pantazopoulos, N. (2018, April 17). Decoding network data from a Gh0st RAT variant. Retrieved November 2, 2018.","url":"https://research.nccgroup.com/2018/04/17/decoding-network-data-from-a-gh0st-rat-variant/"}]},{"id":"S0167","name":"Matryoshka","url":"https://attack.mitre.org/software/S0167","kind":"malware","description":"[Matryoshka](https://attack.mitre.org/software/S0167) is capable of providing Meterpreter shell access.(Citation: ClearSky Wilted Tulip July 2017)","relationship_id":"relationship--3ba2b8bc-1c5b-4cb3-8234-a7dc7b7552d0","references":[{"source_name":"ClearSky Wilted Tulip July 2017","description":"ClearSky Cyber Security and Trend Micro. (2017, July). Operation Wilted Tulip: Exposing a cyber espionage apparatus. Retrieved August 21, 2017.","url":"http://www.clearskysec.com/wp-content/uploads/2017/07/Operation_Wilted_Tulip.pdf"}]},{"id":"S0219","name":"WINERACK","url":"https://attack.mitre.org/software/S0219","kind":"malware","description":"[WINERACK](https://attack.mitre.org/software/S0219) can create a reverse shell that utilizes statically-linked Wine cmd.exe code to emulate Windows command prompt commands.(Citation: FireEye APT37 Feb 2018)","relationship_id":"relationship--819a5c4e-2bd6-4d9b-844c-21dc31e85a67","references":[{"source_name":"FireEye APT37 Feb 2018","description":"FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"}]},{"id":"S0234","name":"Bandook","url":"https://attack.mitre.org/software/S0234","kind":"malware","description":"[Bandook](https://attack.mitre.org/software/S0234) can support commands to execute Java-based payloads.(Citation: CheckPoint Bandook Nov 2020) ","relationship_id":"relationship--89e07be1-6d8b-4886-ab3d-68fb23275c8c","references":[{"source_name":"CheckPoint Bandook Nov 2020","description":"Check Point. (2020, November 26). Bandook: Signed & Delivered. Retrieved May 31, 2021.","url":"https://research.checkpoint.com/2020/bandook-signed-delivered/"}]},{"id":"S0330","name":"Zeus Panda","url":"https://attack.mitre.org/software/S0330","kind":"malware","description":"[Zeus Panda](https://attack.mitre.org/software/S0330) can launch remote scripts on the victim’s machine.(Citation: GDATA Zeus Panda June 2017)\t","relationship_id":"relationship--9317c15e-44ae-4d00-9f2b-ad1b07ff52b5","references":[{"source_name":"GDATA Zeus Panda June 2017","description":"Ebach, L. (2017, June 22). Analysis Results of Zeus.Variant.Panda. Retrieved November 5, 2018.","url":"https://cyberwtf.files.wordpress.com/2017/07/panda-whitepaper.pdf"}]},{"id":"S0334","name":"DarkComet","url":"https://attack.mitre.org/software/S0334","kind":"malware","description":"[DarkComet](https://attack.mitre.org/software/S0334) can execute various types of scripts on the victim’s machine.(Citation: Malwarebytes DarkComet March 2018)","relationship_id":"relationship--1d1eaec4-ceeb-4fda-b177-f92fad7d3e44","references":[{"source_name":"Malwarebytes DarkComet March 2018","description":"Kujawa, A. (2018, March 27). You dirty RAT! Part 1: DarkComet. Retrieved November 6, 2018.","url":"https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/"}]},{"id":"S0363","name":"Empire","url":"https://attack.mitre.org/software/S0363","kind":"tool","description":"[Empire](https://attack.mitre.org/software/S0363) uses a command-line interface to interact with systems.(Citation: Github PowerShell Empire)","relationship_id":"relationship--ee448e12-4b71-4c0c-bcca-daff26072d41","references":[{"source_name":"Github PowerShell Empire","description":"Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016.","url":"https://github.com/PowerShellEmpire/Empire"}]},{"id":"S0374","name":"SpeakUp","url":"https://attack.mitre.org/software/S0374","kind":"malware","description":"[SpeakUp](https://attack.mitre.org/software/S0374) uses Perl scripts.(Citation: CheckPoint SpeakUp Feb 2019)","relationship_id":"relationship--9b174c9b-eab5-4715-aa31-915689054baa","references":[{"source_name":"CheckPoint SpeakUp Feb 2019","description":"Check Point Research. (2019, February 4). SpeakUp: A New Undetected Backdoor Linux Trojan. Retrieved April 17, 2019.","url":"https://research.checkpoint.com/speakup-a-new-undetected-backdoor-linux-trojan/"}]},{"id":"S0434","name":"Imminent Monitor","url":"https://attack.mitre.org/software/S0434","kind":"tool","description":"[Imminent Monitor](https://attack.mitre.org/software/S0434) has a CommandPromptPacket and ScriptPacket module(s) for creating a remote shell and executing scripts.(Citation: QiAnXin APT-C-36 Feb2019)","relationship_id":"relationship--45c4d1f9-414f-4542-8272-c783f7314514","references":[{"source_name":"QiAnXin APT-C-36 Feb2019","description":"QiAnXin Threat Intelligence Center. (2019, February 18). APT-C-36: Continuous Attacks Targeting Colombian Government Institutions and Corporations. Retrieved May 5, 2020.","url":"https://web.archive.org/web/20190625182633if_/https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/"}]},{"id":"S0460","name":"Get2","url":"https://attack.mitre.org/software/S0460","kind":"malware","description":"[Get2](https://attack.mitre.org/software/S0460) has the ability to run executables with command-line arguments.(Citation: Proofpoint TA505 October 2019)","relationship_id":"relationship--c14e629a-c0cd-4600-873b-924d04d8b627","references":[{"source_name":"Proofpoint TA505 October 2019","description":"Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader"}]},{"id":"S0486","name":"Bonadan","url":"https://attack.mitre.org/software/S0486","kind":"malware","description":"[Bonadan](https://attack.mitre.org/software/S0486) can create bind and reverse shells on the infected system.(Citation: ESET ForSSHe December 2018)\t","relationship_id":"relationship--f56f953d-7df2-4eee-93b6-f2c8377153bb","references":[{"source_name":"ESET ForSSHe December 2018","description":"Dumont, R., M.Léveillé, M., Porcher, H. (2018, December 1). THE DARK SIDE OF THE FORSSHE A landscape of OpenSSH backdoors. Retrieved July 16, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"}]},{"id":"S0487","name":"Kessel","url":"https://attack.mitre.org/software/S0487","kind":"malware","description":"[Kessel](https://attack.mitre.org/software/S0487) can create a reverse shell between the infected host and a specified system.(Citation: ESET ForSSHe December 2018)\t","relationship_id":"relationship--46da305e-d59a-42a4-9d2b-cdd223c69664","references":[{"source_name":"ESET ForSSHe December 2018","description":"Dumont, R., M.Léveillé, M., Porcher, H. (2018, December 1). THE DARK SIDE OF THE FORSSHE A landscape of OpenSSH backdoors. Retrieved July 16, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"}]},{"id":"S0598","name":"P.A.S. Webshell","url":"https://attack.mitre.org/software/S0598","kind":"malware","description":"[P.A.S. Webshell](https://attack.mitre.org/software/S0598) has the ability to create reverse shells with Perl scripts.(Citation: ANSSI Sandworm January 2021)","relationship_id":"relationship--7e3bdb4d-76b3-42ce-8f68-587320e39ec7","references":[{"source_name":"ANSSI Sandworm January 2021","description":"ANSSI. (2021, January 27). SANDWORM INTRUSION SET CAMPAIGN TARGETING CENTREON SYSTEMS. Retrieved March 30, 2021.","url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"}]},{"id":"S0618","name":"FIVEHANDS","url":"https://attack.mitre.org/software/S0618","kind":"malware","description":"[FIVEHANDS](https://attack.mitre.org/software/S0618) can receive a command line argument to limit file encryption to specified directories.(Citation: FireEye FiveHands April 2021)(Citation: NCC Group Fivehands June 2021)","relationship_id":"relationship--35887eab-0306-4e28-910d-2235207cc621","references":[{"source_name":"FireEye FiveHands April 2021","description":"McLellan, T.  and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.","url":"https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"},{"source_name":"NCC Group Fivehands June 2021","description":"Matthews, M. and Backhouse, W. (2021, June 15). Handy guide to a new Fivehands ransomware variant. Retrieved June 24, 2021.","url":"https://research.nccgroup.com/2021/06/15/handy-guide-to-a-new-fivehands-ransomware-variant/"}]},{"id":"S0695","name":"Donut","url":"https://attack.mitre.org/software/S0695","kind":"tool","description":"[Donut](https://attack.mitre.org/software/S0695) can generate shellcode outputs that execute via Ruby.(Citation: Donut Github)\t","relationship_id":"relationship--34351a4f-ea7c-4420-9063-1d8644073ea7","references":[{"source_name":"Donut Github","description":"TheWover. (2019, May 9). donut. Retrieved March 25, 2022.","url":"https://github.com/TheWover/donut"}]},{"id":"S1110","name":"SLIGHTPULSE","url":"https://attack.mitre.org/software/S1110","kind":"malware","description":"[SLIGHTPULSE](https://attack.mitre.org/software/S1110) contains functionality to execute arbitrary commands passed to it.(Citation: Mandiant Pulse Secure Zero-Day April 2021)","relationship_id":"relationship--81c7148b-3608-40ac-bd35-a72d88207d52","references":[{"source_name":"Mandiant Pulse Secure Zero-Day April 2021","description":"Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024.","url":"https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day"}]},{"id":"S1130","name":"Raspberry Robin","url":"https://attack.mitre.org/software/S1130","kind":"malware","description":"[Raspberry Robin](https://attack.mitre.org/software/S1130) variants can be delivered via highly obfuscated Windows Script Files (WSF) for initial execution.(Citation: HP RaspberryRobin 2024)","relationship_id":"relationship--f34e6a88-bb49-47cc-b0bc-1d2abb63aa56","references":[{"source_name":"HP RaspberryRobin 2024","description":"Patrick Schläpfer . (2024, April 10). Raspberry Robin Now Spreading Through Windows Script Files. Retrieved May 17, 2024.","url":"https://threatresearch.ext.hp.com/raspberry-robin-now-spreading-through-windows-script-files/"}]},{"id":"S1151","name":"ZeroCleare","url":"https://attack.mitre.org/software/S1151","kind":"malware","description":"[ZeroCleare](https://attack.mitre.org/software/S1151) can receive command line arguments from an operator to corrupt the file system using the [RawDisk](https://attack.mitre.org/software/S0364) driver.(Citation: Mandiant ROADSWEEP August 2022)","relationship_id":"relationship--65684059-3a14-431f-8380-9b940b9a1fc1","references":[{"source_name":"Mandiant ROADSWEEP August 2022","description":"Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"}]},{"id":"S1154","name":"VersaMem","url":"https://attack.mitre.org/software/S1154","kind":"malware","description":"[VersaMem](https://attack.mitre.org/software/S1154) was delivered as a Java Archive (JAR) that runs by attaching itself to the Apache Tomcat Java servlet and web server.(Citation: Lumen Versa 2024)","relationship_id":"relationship--8e29c8f6-8155-47b3-9704-1ba93586af3a","references":[{"source_name":"Lumen Versa 2024","description":"Black Lotus Labs. (2024, August 27). Taking The Crossroads: The Versa Director Zero-Day Exploitaiton. Retrieved August 27, 2024.","url":"https://blog.lumen.com/taking-the-crossroads-the-versa-director-zero-day-exploitation/"}]},{"id":"S1192","name":"NICECURL","url":"https://attack.mitre.org/software/S1192","kind":"malware","description":"[NICECURL](https://attack.mitre.org/software/S1192) has provided an arbitrary command execution interface.(Citation: Mandiant APT42-untangling) ","relationship_id":"relationship--941a62af-7c95-466d-8575-95d61198e82e","references":[{"source_name":"Mandiant APT42-untangling","description":"Rozmann, O., et al. (2024, May 1). Uncharmed: Untangling Iran's APT42 Operations. Retrieved October 9, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations"}]},{"id":"S1227","name":"StarProxy","url":"https://attack.mitre.org/software/S1227","kind":"malware","description":"[StarProxy](https://attack.mitre.org/software/S1227) has used the command line for execution of commands.(Citation: Zscaler)","relationship_id":"relationship--29ff7a09-f6d2-4a3a-a851-c9054e5fe9f8","references":[{"source_name":"Zscaler","description":"Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"}]},{"id":"S9032","name":"MuddyViper","url":"https://attack.mitre.org/software/S9032","kind":"malware","description":"[MuddyViper](https://attack.mitre.org/software/S9032) has launched a reverse shell using a provided command line.(Citation: ESET_MuddyWater_Dec2025)","relationship_id":"relationship--d8133f0a-2f24-4697-b5f5-3a0d60c6b3dd","references":[{"source_name":"ESET_MuddyWater_Dec2025","description":"ESET Research. (2025, December 2). MuddyWater: Snakes by the riverbank. Retrieved February 17, 2026.","url":"https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"}]}],"actors":[{"id":"G0004","name":"Ke3chang","url":"https://attack.mitre.org/groups/G0004","kind":"intrusion-set","description":"Malware used by [Ke3chang](https://attack.mitre.org/groups/G0004) can run commands on the command-line interface.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: NCC Group APT15 Alive and Strong)","relationship_id":"relationship--a5a63d5c-acf7-4720-866d-fcf6e576a58f","references":[{"source_name":"Mandiant Operation Ke3chang November 2014","description":"Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014.","url":"https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs"},{"source_name":"NCC Group APT15 Alive and Strong","description":"Smallridge, R. (2018, March 10). APT15 is alive and strong: An analysis of RoyalCli and RoyalDNS. Retrieved April 4, 2018.","url":"https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"}]},{"id":"G0035","name":"Dragonfly","url":"https://attack.mitre.org/groups/G0035","kind":"intrusion-set","description":"[Dragonfly](https://attack.mitre.org/groups/G0035) has used the command line for execution.(Citation: US-CERT TA18-074A)","relationship_id":"relationship--769a2214-5e04-4290-a172-b770f8bb223e","references":[{"source_name":"US-CERT TA18-074A","description":"US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"id":"G0037","name":"FIN6","url":"https://attack.mitre.org/groups/G0037","kind":"intrusion-set","description":"[FIN6](https://attack.mitre.org/groups/G0037) has used scripting to iterate through a list of compromised PoS systems, copy data to a log file, and remove the original data files.(Citation: FireEye FIN6 April 2016)(Citation: FireEye FIN6 Apr 2019)","relationship_id":"relationship--1f764874-0e08-4799-9487-a9e12c499c13","references":[{"source_name":"FireEye FIN6 April 2016","description":"FireEye Threat Intelligence. (2016, April). Follow the Money: Dissecting the Operations of the Cyber Crime Group FIN6. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf"},{"source_name":"FireEye FIN6 Apr 2019","description":"McKeague, B. et al. (2019, April 5). Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware. Retrieved April 17, 2019.","url":"https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html"}]},{"id":"G0038","name":"Stealth Falcon","url":"https://attack.mitre.org/groups/G0038","kind":"intrusion-set","description":"[Stealth Falcon](https://attack.mitre.org/groups/G0038) malware uses WMI to script data collection and command execution on the victim.(Citation: Citizen Lab Stealth Falcon May 2016)","relationship_id":"relationship--0d63f3cf-bace-4210-9b76-199c5cdb8764","references":[{"source_name":"Citizen Lab Stealth Falcon May 2016","description":"Marczak, B. and Scott-Railton, J.. (2016, May 29). Keep Calm and (Don’t) Enable Macros: A New Threat Actor Targets UAE Dissidents. Retrieved June 8, 2016.","url":"https://citizenlab.org/2016/05/stealth-falcon/"}]},{"id":"G0046","name":"FIN7","url":"https://attack.mitre.org/groups/G0046","kind":"intrusion-set","description":"[FIN7](https://attack.mitre.org/groups/G0046) used SQL scripts to help perform tasks on the victim's machine.(Citation: FireEye FIN7 Aug 2018)(Citation: Flashpoint FIN 7 March 2019)(Citation: FireEye FIN7 Aug 2018)","relationship_id":"relationship--1332e859-38be-45ed-9ebc-09efd7117c17","references":[{"source_name":"FireEye FIN7 Aug 2018","description":"Carr, N., et al. (2018, August 01). On the Hunt for FIN7: Pursuing an Enigmatic and Evasive Global Criminal Operation. Retrieved August 23, 2018.","url":"https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"},{"source_name":"Flashpoint FIN 7 March 2019","description":"Platt, J. and Reeves, J.. (2019, March). FIN7 Revisited: Inside Astra Panel and SQLRat Malware. Retrieved June 18, 2019.","url":"https://www.flashpoint-intel.com/blog/fin7-revisited-inside-astra-panel-and-sqlrat-malware/"},{"source_name":"FireEye FIN7 Aug 2018","description":"Carr, N., et al. (2018, August 01). On the Hunt for FIN7: Pursuing an Enigmatic and Evasive Global Criminal Operation. Retrieved August 23, 2018.","url":"https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"}]},{"id":"G0049","name":"OilRig","url":"https://attack.mitre.org/groups/G0049","kind":"intrusion-set","description":"[OilRig](https://attack.mitre.org/groups/G0049) has used various types of scripting for execution.(Citation: FireEye APT34 Dec 2017)(Citation: OilRig ISMAgent July 2017)(Citation: Unit 42 OopsIE! Feb 2018)(Citation: Unit 42 QUADAGENT July 2018)(Citation: Unit42 OilRig Nov 2018)","relationship_id":"relationship--e8ce10b4-3b00-40c1-983a-1d87ff9a68ee","references":[{"source_name":"FireEye APT34 Dec 2017","description":"Sardiwal, M, et al. (2017, December 7). New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit. Retrieved December 20, 2017.","url":"https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"},{"source_name":"OilRig ISMAgent July 2017","description":"Falcone, R. and Lee, B. (2017, July 27). OilRig Uses ISMDoor Variant; Possibly Linked to Greenbug Threat Group. Retrieved January 8, 2018.","url":"https://researchcenter.paloaltonetworks.com/2017/07/unit42-oilrig-uses-ismdoor-variant-possibly-linked-greenbug-threat-group/"},{"source_name":"Unit 42 OopsIE! Feb 2018","description":"Lee, B., Falcone, R. (2018, February 23). OopsIE! OilRig Uses ThreeDollars to Deliver New Trojan. Retrieved July 16, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/02/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/"},{"source_name":"Unit 42 QUADAGENT July 2018","description":"Lee, B., Falcone, R. (2018, July 25). OilRig Targets Technology Service Provider and Government Agency with QUADAGENT. Retrieved August 9, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/07/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/"},{"source_name":"Unit42 OilRig Nov 2018","description":"Falcone, R., Wilhoit, K.. (2018, November 16). Analyzing OilRig’s Ops Tempo from Testing to Weaponization to Delivery. Retrieved April 23, 2019.","url":"https://unit42.paloaltonetworks.com/unit42-analyzing-oilrigs-ops-tempo-testing-weaponization-delivery/"}]},{"id":"G0050","name":"APT32","url":"https://attack.mitre.org/groups/G0050","kind":"intrusion-set","description":"[APT32](https://attack.mitre.org/groups/G0050) has used COM scriptlets to download Cobalt Strike beacons.(Citation: Cybereason Cobalt Kitty 2017)\t","relationship_id":"relationship--768a6678-4823-4af5-bfd9-1a92c562b9f2","references":[{"source_name":"Cybereason Cobalt Kitty 2017","description":"Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"id":"G0053","name":"FIN5","url":"https://attack.mitre.org/groups/G0053","kind":"intrusion-set","description":"[FIN5](https://attack.mitre.org/groups/G0053) scans processes on all victim systems in the environment and uses automated scripts to pull back the results.(Citation: Mandiant FIN5 GrrCON Oct 2016)","relationship_id":"relationship--39590383-ba69-4d8f-9520-e893cd4ebcdf","references":[{"source_name":"Mandiant FIN5 GrrCON Oct 2016","description":"Bromiley, M. and Lewis, P. (2016, October 7). Attacking the Hospitality and Gaming Industries: Tracking an Attacker Around the World in 7 Years. Retrieved October 6, 2017.","url":"https://www.youtube.com/watch?v=fevGZs0EQu8"}]},{"id":"G0067","name":"APT37","url":"https://attack.mitre.org/groups/G0067","kind":"intrusion-set","description":"[APT37](https://attack.mitre.org/groups/G0067) has used Ruby scripts to execute payloads.(Citation: Volexity InkySquid RokRAT August 2021)","relationship_id":"relationship--b906b0a1-12a3-4d6f-82ec-d72a4ef711b4","references":[{"source_name":"Volexity InkySquid RokRAT August 2021","description":"Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.","url":"https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"}]},{"id":"G0073","name":"APT19","url":"https://attack.mitre.org/groups/G0073","kind":"intrusion-set","description":"[APT19](https://attack.mitre.org/groups/G0073) downloaded and launched code within a SCT file.(Citation: FireEye APT19)","relationship_id":"relationship--4f2e62d0-5345-45dc-9e9d-46bb11c5f35d","references":[{"source_name":"FireEye APT19","description":"Ahl, I. (2017, June 06). Privileges and Credentials: Phished at the Request of Counsel. Retrieved May 17, 2018.","url":"https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html"}]},{"id":"G0087","name":"APT39","url":"https://attack.mitre.org/groups/G0087","kind":"intrusion-set","description":"[APT39](https://attack.mitre.org/groups/G0087) has utilized custom scripts to perform internal reconnaissance.(Citation: FireEye APT39 Jan 2019)(Citation: FBI FLASH APT39 September 2020)","relationship_id":"relationship--a1c62ce5-2f11-415f-bca1-c9021530c090","references":[{"source_name":"FBI FLASH APT39 September 2020","description":"FBI. (2020, September 17). Indicators of Compromise Associated with Rana Intelligence Computing, also known as Advanced Persistent Threat 39, Chafer, Cadelspy, Remexi, and ITG07. Retrieved December 10, 2020.","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"},{"source_name":"FireEye APT39 Jan 2019","description":"Hawley et al. (2019, January 29). APT39: An Iranian Cyber Espionage Group Focused on Personal Information. Retrieved February 19, 2019.","url":"https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html"}]},{"id":"G0107","name":"Whitefly","url":"https://attack.mitre.org/groups/G0107","kind":"intrusion-set","description":"[Whitefly](https://attack.mitre.org/groups/G0107) has used a simple remote shell tool that will call back to the C2 server and wait for commands.(Citation: Symantec Whitefly March 2019)","relationship_id":"relationship--92b00f56-c9ac-4e48-9890-40b78ab0c361","references":[{"source_name":"Symantec Whitefly March 2019","description":"Symantec. (2019, March 6). Whitefly: Espionage Group has Singapore in Its Sights. Retrieved May 26, 2020.","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/whitefly-espionage-singapore"}]},{"id":"G0117","name":"Fox Kitten","url":"https://attack.mitre.org/groups/G0117","kind":"intrusion-set","description":"[Fox Kitten](https://attack.mitre.org/groups/G0117) has used a Perl reverse shell to communicate with C2.(Citation: ClearSky Pay2Kitten December 2020)","relationship_id":"relationship--00fb61de-33f5-4e85-aca3-8e4016aa0bf8","references":[{"source_name":"ClearSky Pay2Kitten December 2020","description":"ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.","url":"https://www.clearskysec.com/wp-content/uploads/2020/12/Pay2Kitten.pdf"}]},{"id":"G0124","name":"Windigo","url":"https://attack.mitre.org/groups/G0124","kind":"intrusion-set","description":"[Windigo](https://attack.mitre.org/groups/G0124) has used a Perl script for information gathering.(Citation: ESET ForSSHe December 2018)","relationship_id":"relationship--bea0bf7c-62c8-4334-b523-5cc6ec8b36c8","references":[{"source_name":"ESET ForSSHe December 2018","description":"Dumont, R., M.Léveillé, M., Porcher, H. (2018, December 1). THE DARK SIDE OF THE FORSSHE A landscape of OpenSSH backdoors. Retrieved July 16, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"}]},{"id":"G0129","name":"Mustang Panda","url":"https://attack.mitre.org/groups/G0129","kind":"intrusion-set","description":"[Mustang Panda](https://attack.mitre.org/groups/G0129) has utilized meterpreter shellcode.(Citation: Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022)","relationship_id":"relationship--bcb23d08-7670-4373-94a0-370191d01297","references":[{"source_name":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","description":"Asheer Malhotra, Jungsoo An, Kendall Mc. (2022, May 5). Mustang Panda deploys a new wave of malware targeting Europe. Retrieved August 4, 2025.","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"}]},{"id":"G1031","name":"Saint Bear","url":"https://attack.mitre.org/groups/G1031","kind":"intrusion-set","description":"[Saint Bear](https://attack.mitre.org/groups/G1031) has used the Windows Script Host (wscript) to execute intermediate files written to victim machines.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )","relationship_id":"relationship--8a7baaae-c0d5-4465-917d-4612232a6dae","references":[{"source_name":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","description":"Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}]},{"id":"G1035","name":"Winter Vivern","url":"https://attack.mitre.org/groups/G1035","kind":"intrusion-set","description":"[Winter Vivern](https://attack.mitre.org/groups/G1035) used XLM 4.0 macros for initial code execution for malicious document files.(Citation: DomainTools WinterVivern 2021)","relationship_id":"relationship--120adfe2-5ad8-49bb-b6e8-e474b306814b","references":[{"source_name":"DomainTools WinterVivern 2021","description":"Chad Anderson. (2021, April 27). Winter Vivern: A Look At Re-Crafted Government MalDocs Targeting Multiple Languages. Retrieved July 29, 2024.","url":"https://www.domaintools.com/resources/blog/winter-vivern-a-look-at-re-crafted-government-maldocs/"}]}],"mitigations":[{"id":"M1021","name":"Restrict Web-Based Content","url":"https://attack.mitre.org/mitigations/M1021","kind":"course-of-action","description":"Script blocking extensions can help prevent the execution of scripts and HTA files that may commonly be used during the exploitation process. For malicious code served up through ads, adblockers can help prevent that code from executing in the first place.","relationship_id":"relationship--d4dbffc2-246d-4fd4-8c3c-0e7901aaef05","references":[]},{"id":"M1026","name":"Privileged Account Management","url":"https://attack.mitre.org/mitigations/M1026","kind":"course-of-action","description":"When PowerShell is necessary, consider restricting PowerShell execution policy to administrators. Be aware that there are methods of bypassing the PowerShell execution policy, depending on environment configuration.(Citation: Netspi PowerShell Execution Policy Bypass)\n\nPowerShell JEA (Just Enough Administration) may also be used to sandbox administration and limit what commands admins/users can execute through remote PowerShell sessions.(Citation: Microsoft PS JEA)","relationship_id":"relationship--ad32e902-6f48-4c8f-bc3d-2fc06f045eed","references":[{"source_name":"Microsoft PS JEA","description":"Microsoft. (2022, November 17). Just Enough Administration. Retrieved March 27, 2023.","url":"https://learn.microsoft.com/powershell/scripting/learn/remoting/jea/overview?view=powershell-7.3"},{"source_name":"Netspi PowerShell Execution Policy Bypass","description":"Sutherland, S. (2014, September 9). 15 Ways to Bypass the PowerShell Execution Policy. Retrieved September 12, 2024.","url":"https://www.netspi.com/blog/technical-blog/network-penetration-testing/15-ways-to-bypass-the-powershell-execution-policy/"}]},{"id":"M1033","name":"Limit Software Installation","url":"https://attack.mitre.org/mitigations/M1033","kind":"course-of-action","description":"Prevent user installation of unrequired command and scripting interpreters.","relationship_id":"relationship--292e29e8-79d9-4b15-930e-a7e26c27ca15","references":[]},{"id":"M1038","name":"Execution Prevention","url":"https://attack.mitre.org/mitigations/M1038","kind":"course-of-action","description":"Use application control where appropriate. For example, PowerShell Constrained Language mode can be used to restrict access to sensitive or otherwise dangerous language elements such as those used to execute arbitrary Windows APIs or files (e.g., `Add-Type`).(Citation: Microsoft PowerShell CLM)","relationship_id":"relationship--87fd0088-41da-47ac-bd69-a8ac151a0d39","references":[{"source_name":"Microsoft PowerShell CLM","description":"PowerShell Team. (2017, November 2). PowerShell Constrained Language Mode. Retrieved March 27, 2023.","url":"https://devblogs.microsoft.com/powershell/powershell-constrained-language-mode/"}]},{"id":"M1040","name":"Behavior Prevention on Endpoint","url":"https://attack.mitre.org/mitigations/M1040","kind":"course-of-action","description":"On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent [Visual Basic](https://attack.mitre.org/techniques/T1059/005) and [JavaScript](https://attack.mitre.org/techniques/T1059/007) scripts from executing potentially malicious downloaded content (Citation: win10_asr).","relationship_id":"relationship--e93059c7-2f60-47f5-af11-bc0a6e7e6d25","references":[{"source_name":"win10_asr","description":"Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.","url":"https://docs.microsoft.com/microsoft-365/security/defender-endpoint/attack-surface-reduction"}]},{"id":"M1042","name":"Disable or Remove Feature or Program","url":"https://attack.mitre.org/mitigations/M1042","kind":"course-of-action","description":"Disable or remove any unnecessary or unused shells or interpreters.","relationship_id":"relationship--6abc6901-d152-4b5f-b27d-8b973ae567cb","references":[]},{"id":"M1045","name":"Code Signing","url":"https://attack.mitre.org/mitigations/M1045","kind":"course-of-action","description":"Where possible, only permit execution of signed scripts.","relationship_id":"relationship--2cf7243f-d5d7-473b-9cb7-27c7186565d3","references":[]},{"id":"M1047","name":"Audit","url":"https://attack.mitre.org/mitigations/M1047","kind":"course-of-action","description":"Inventory systems for unauthorized command and scripting interpreter installations.","relationship_id":"relationship--c8ff4bb6-92df-40ca-b975-6682d7c6ac82","references":[]},{"id":"M1049","name":"Antivirus/Antimalware","url":"https://attack.mitre.org/mitigations/M1049","kind":"course-of-action","description":"Anti-virus can be used to automatically quarantine suspicious files. ","relationship_id":"relationship--8d56622d-547a-4daa-89b8-1c555d1ac5b7","references":[]}],"candidates":[{"id":"a9b93f17-31cb-435d-a462-5e838a2a6026","name":"AutoIt Script Execution","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1059/T1059.yaml","description":"An adversary may attempt to execute suspicious or malicious script using AutoIt software instead of regular terminal like powershell or cmd. Calculator will popup when the script is executed successfully.\n","inputs":{"script_path":{"description":"AutoIt Script Path","type":"path","default":"PathToAtomicsFolder\\T1059\\src\\calc.au3"},"autoit_path":{"description":"AutoIt Executable File Path","type":"path","default":"C:\\Program Files (x86)\\AutoIt3\\AutoIt3.exe"}},"dependencies":[{"description":"AutoIt executable file must exist on disk at the specified location (#{autoit_path})\n"}],"source_definition_sha256":"9bdfe9b3cfad88ab98077338819a1c6695c22a9740af841bef57f61117ba951c"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1059.004":"/ttp-simulation/techniques/enterprise/T1059.004/","T1059.003":"/ttp-simulation/techniques/enterprise/T1059.003/","T1059.001":"/ttp-simulation/techniques/enterprise/T1059.001/","T1059.006":"/ttp-simulation/techniques/enterprise/T1059.006/","T1059.007":"/ttp-simulation/techniques/enterprise/T1059.007/","T1059.005":"/ttp-simulation/techniques/enterprise/T1059.005/","T1021":"/ttp-simulation/techniques/enterprise/T1021/","T1059":"/ttp-simulation/techniques/enterprise/T1059/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1059","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0002","collector":"illustrative-lab-collector","observation":{"account":"analyst@example.test","application":"lab-portal","result":"failure","reason":"invalid_credential","source_ip":"192.0.2.10"}}]}}