{"source_checked_on":"2026-10-19","schema_version":1,"key":"ics/T1701.006","id":"T1701.006","name":"JavaScript","domain":"ics","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1701/006","source_file":{"file":"ics.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/ics-attack/ics-attack-20.0.json","sha256":"c9ca0ce523a1b5e512060a390415e8aefe8f6d32c5f82d7de81264960c1e1183","bytes":5266683},"source_object_sha256":"0066160efff207fbbb3d999c30ce82efb6b80d5bd397916bb2abcc8f23e8a232","description":"Adversaries may abuse various implementations of JavaScript for execution. JavaScript is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JavaScript can be executed in runtime environments outside the browser.(Citation: NodeJS)\n\nJScript is the Microsoft implementation of the same scripting standard. JScript is interpreted via the Windows Script engine and thus integrated with many components of Windows such as the [Component Object Model](https://attack.mitre.org/techniques/T1559/001) and Internet Explorer HTML Application (HTA) pages.(Citation: JScrip May 2018)(Citation: Microsoft JScript 2007)(Citation: Microsoft Windows Scripts)\n\nAdversaries may abuse various implementations of JavaScript to execute various behaviors. Common uses include hosting malicious scripts on websites as part of a [Drive-by Compromise](https://attack.mitre.org/techniques/T0817) or downloading and executing these script files as secondary payloads. Since these payloads are text-based, it is also very common for adversaries to obfuscate their content as part of [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027).\n\nWithin industrial control system networks, adversaries most commonly abuse the use of JavaScript on overlap assets that run on operating system platforms similar to Enterprise devices. \n","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1701/006","external_id":"T1701.006"},{"source_name":"Microsoft JScript 2007","description":"Microsoft. (2007, August 15). The World of JScript, JavaScript, ECMAScript …. Retrieved June 23, 2020.","url":"https://docs.microsoft.com/archive/blogs/gauravseth/the-world-of-jscript-javascript-ecmascript"},{"source_name":"Microsoft Windows Scripts","description":"Microsoft. (2017, January 18). Windows Script Interfaces. Retrieved June 23, 2020.","url":"https://docs.microsoft.com/scripting/winscript/windows-script-interfaces"},{"source_name":"JScrip May 2018","description":"Microsoft. (2018, May 31). Translating to JScript. Retrieved June 23, 2020.","url":"https://docs.microsoft.com/windows/win32/com/translating-to-jscript"},{"source_name":"NodeJS","description":"OpenJS Foundation. (n.d.). Node.js. Retrieved June 23, 2020.","url":"https://nodejs.org/"}],"platforms":[],"environments":["ics-ot"],"visibility":"source_mapped","visibility_note":null,"parent":{"key":"ics/T1701","id":"T1701","name":"Command and Scripting Interpreter","domain":"ics","level":"technique","parent_id":null,"tactics":["execution"],"platforms":[],"environments":["ics-ot"],"page":"techniques/ics/T1701/","constraints":["isolated_authorized_lab","procedure_review_required","telemetry_configuration_required","ot_fixture_and_process_safety_review"],"telemetry_tags":["Command Execution","Process Creation"],"telemetry_references":[{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"detections":{"page":"detections/ics/T1701/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},"detection_status":"guidance_only","anomaly_tags":[],"tool_tags":[],"tool_references":[],"visibility":"source_mapped","telemetry_status":"mapped","classification":"cannot_simulate_yet","candidate_count":0,"implementation":"not_integrated","methods":[]},"children":[],"telemetry":[{"id":"DC0016","name":"Module Load","page":"telemetry/DC0016/","kind":"attack_component","category":"Endpoint activity","description":"A module or library being loaded into a running process.","collection_focus":"Scope Sysmon ImageLoad (7) to lab processes/paths; retain module hash, signer and destination process. Inventory alone does not prove a module loaded.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","image_loaded","signed","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"ics/T1701.006","id":"T1701.006","name":"JavaScript","domain":"ics","platforms":[],"environments":["ics-ot"],"source_url":"https://attack.mitre.org/techniques/T1701/006","technique_page":"techniques/ics/T1701.006/","page":"detections/ics/T1701.006/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0936","name":"Behavioral Detection of JavaScript Execution in ICS","url":"https://attack.mitre.org/detectionstrategies/DET0936","stix_id":"x-mitre-detection-strategy--a24f6d21-a614-46bd-9817-f55a576a05ea","relationship_id":"relationship--de520a68-3ad7-4bd2-a4a6-2380e328e929","description":"","analytics":[{"id":"AN2092","name":"Analytic 2092","guidance":"Real-time monitoring identifies wscript.exe/cscript.exe/mshta.exe or other JScript execution from unexpected parents/paths, especially when followed by child interpreters, network connections, or system modification. Alert only when the interpreter is not part of the asset's approved software/automation baseline or its execution context violates an approved signer/hash/path/parent/user rule, and require OT-relevant corroboration such as access to engineering files, ICS software/API use, communications with protected OT assets, configuration change, or another suspicious follow-on behavior. Suppress documented vendor software, engineering workflows, diagnostics, backup, patching, and approved maintenance.","url":"https://attack.mitre.org/detectionstrategies/DET0936#AN2092","platforms":["Windows"],"tuning":[{"field":"ApprovedScriptHosts","description":"Allowed script hosts and vendor applications"},{"field":"ParentProcess","description":"Expected parent-child relationships"},{"field":"ScriptPath","description":"Approved script locations"},{"field":"UserContext","description":"Authorized users/services"},{"field":"MaintenanceWindow","description":"Approved automation/support windows"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon ","channel":"EventCode=1; wscript.exe/cscript.exe/mshta.exe and child-process lineage ","platforms":["Windows"],"analytic_id":"AN2092","source_url":"https://attack.mitre.org/detectionstrategies/DET0936#AN2092","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0016","component":"Module Load","name":"WinEventLog:Sysmon","channel":"EventCode=7; scripting-engine module loads when useful ","platforms":["Windows"],"analytic_id":"AN2092","source_url":"https://attack.mitre.org/detectionstrategies/DET0936#AN2092","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0016/"}]},{"id":"AN2093","name":"Analytic 2093","guidance":"Real-time monitoring identifies node/nodejs or another JavaScript runtime launched from an unexpected service, web process, scheduled task, user, or path, followed by outbound connections, shell execution, persistence, or OT-relevant access. Alert only when the interpreter/shell is not expected for the asset role or user/service context, or when its parent, path, arguments, remote-session source, or follow-on behavior violates the approved OT baseline. Suppress approved engineering scripts, vendor support, diagnostics, backup, patching, and maintenance windows.","url":"https://attack.mitre.org/detectionstrategies/DET0936#AN2093","platforms":["Linux"],"tuning":[{"field":"ApprovedRuntime","description":"Approved Node.js/runtime paths and versions"},{"field":"ParentProcess","description":"Expected service/application parents"},{"field":"ScriptPath","description":"Approved application/script locations"},{"field":"UserContext","description":"Expected service users"},{"field":"ApprovedDestinations","description":"Expected OT/external communications"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve for node/nodejs or JavaScript runtime and child processes ","platforms":["Linux"],"analytic_id":"AN2093","source_url":"https://attack.mitre.org/detectionstrategies/DET0936#AN2093","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"linux:osquery","channel":"socket_events for runtime-originated connections, where deployed ","platforms":["Linux"],"analytic_id":"AN2093","source_url":"https://attack.mitre.org/detectionstrategies/DET0936#AN2093","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]}]}],"telemetry_references":[{"id":"DC0016","name":"Module Load","tag":"Module Load","page":"telemetry/DC0016/","kind":"attack_component"},{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0496","name":"REvil","url":"https://attack.mitre.org/software/S0496","kind":"malware","description":"[REvil](https://attack.mitre.org/software/S0496) utilizes JavaScript, WScript, and PowerShell scripts to execute. The malicious JavaScript attachment has an obfuscated PowerShell script that executes the malware. (Citation: Tom Fakterman August 2019)","relationship_id":"relationship--b270a54c-2a59-46a1-a0b1-4e626bba0b25","references":[{"source_name":"Tom Fakterman August 2019","description":"Tom Fakterman 2019, August 05 Sodinokibi: The Crown Prince of Ransomware Retrieved. 2021/04/12 ","url":"https://www.cybereason.com/blog/the-sodinokibi-ransomware-attack"}]}],"actors":[],"mitigations":[{"id":"M0921","name":"Restrict Web-Based Content","url":"https://attack.mitre.org/mitigations/M0921","kind":"course-of-action","description":"Restrict untrusted web content and active scripting on ICS workstations, jump hosts, and other overlap assets, especially where browser access is not required for operations.","relationship_id":"relationship--419a1f4b-b36e-44ec-8a91-d4138c5fb353","references":[]},{"id":"M0938","name":"Execution Prevention","url":"https://attack.mitre.org/mitigations/M0938","kind":"course-of-action","description":"Use application control to restrict wscript.exe, cscript.exe, mshta.exe, Node.js, and other JavaScript runtimes to approved paths, parent processes, scripts, and users.","relationship_id":"relationship--4c10bd09-f51b-4190-811d-8ee3c6fb7696","references":[]},{"id":"M0942","name":"Disable or Remove Feature or Program","url":"https://attack.mitre.org/mitigations/M0942","kind":"course-of-action","description":"Disable or remove JavaScript/JScript execution surfaces that are not required for the documented role of an ICS asset, while preserving validated HMI, vendor, and engineering dependencies.","relationship_id":"relationship--10346185-5437-4317-a9f9-88561a8a1f08","references":[]},{"id":"M0950","name":"Exploit Protection","url":"https://attack.mitre.org/mitigations/M0950","kind":"course-of-action","description":"Harden browsers, HTML applications, and Windows scripting hosts that can execute JavaScript/JScript on ICS overlap assets.","relationship_id":"relationship--7f4b7026-a747-49db-9b28-aff3de16afb2","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use a process simulator or isolated test rig with no connection to production controllers or physical actuators. Preserve safety interlocks; destructive effects require synthetic evidence, not real equipment damage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1559.001":"/ttp-simulation/techniques/enterprise/T1559.001/","T0817":"/ttp-simulation/techniques/ics/T0817/","T1027":"/ttp-simulation/techniques/enterprise/T1027/","T1701.006":"/ttp-simulation/techniques/ics/T1701.006/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"ics/T1701.006","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}