{"source_checked_on":"2026-10-19","schema_version":1,"key":"ics/T1701","id":"T1701","name":"Command and Scripting Interpreter","domain":"ics","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1701","source_file":{"file":"ics.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/ics-attack/ics-attack-20.0.json","sha256":"c9ca0ce523a1b5e512060a390415e8aefe8f6d32c5f82d7de81264960c1e1183","bytes":5266683},"source_object_sha256":"fbf2b87c574d5f2c1a1afd1cc4163dbf1000531e75ef86f3beee6dff90cea4dc","description":"Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms within industrial control system environments. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of [Unix Shell](https://attack.mitre.org/techniques/T1701/003) while Windows installations include the [Windows Command Shell](https://attack.mitre.org/techniques/T1701/002) and [PowerShell](https://attack.mitre.org/techniques/T1701/001). Some also have cross-platform interpreters such as [Python](https://attack.mitre.org/techniques/T1701/005), as well as those commonly associated with client applications such as [JavaScript](https://attack.mitre.org/techniques/T1701/006) and [Visual Basic](https://attack.mitre.org/techniques/T1701/004). Many controllers have command-line interfaces for management purposes. \n\nAdversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in [Initial Access](https://attack.mitre.org/tactics/TA0108) payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various [Remote Services](https://attack.mitre.org/techniques/T0886) (e.g., Telnet, SSH, RDP, etc.) often found in industrial control system environments to achieve remote [Execution](https://attack.mitre.org/tactics/TA0104).(Citation: Powershell Remote Commands)(Citation: Cisco IOS Software Integrity Assurance - Command History)(Citation: Remote Shell Execution in Python)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1701","external_id":"T1701"},{"source_name":"Remote Shell Execution in Python","description":"Abdou Rockikz. (2020, July). How to Execute Shell Commands in a Remote Machine in Python. Retrieved July 26, 2021.","url":"https://www.thepythoncode.com/article/executing-bash-commands-remotely-in-python"},{"source_name":"Cisco IOS Software Integrity Assurance - Command History","description":"Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Command History. Retrieved October 21, 2020.","url":"https://tools.cisco.com/security/center/resources/integrity_assurance.html#23"},{"source_name":"Powershell Remote Commands","description":"Microsoft. (2020, August 21). Running Remote Commands. Retrieved July 26, 2021.","url":"https://docs.microsoft.com/en-us/powershell/scripting/learn/remoting/running-remote-commands?view=powershell-7.1"}],"platforms":[],"environments":["ics-ot"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"ics/T1701.001","id":"T1701.001","name":"PowerShell","page":"techniques/ics/T1701.001/"},{"key":"ics/T1701.002","id":"T1701.002","name":"Windows Command Shell","page":"techniques/ics/T1701.002/"},{"key":"ics/T1701.003","id":"T1701.003","name":"Unix Shell","page":"techniques/ics/T1701.003/"},{"key":"ics/T1701.004","id":"T1701.004","name":"Visual Basic","page":"techniques/ics/T1701.004/"},{"key":"ics/T1701.005","id":"T1701.005","name":"Python","page":"techniques/ics/T1701.005/"},{"key":"ics/T1701.006","id":"T1701.006","name":"JavaScript","page":"techniques/ics/T1701.006/"}],"telemetry":[{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"ics/T1701","id":"T1701","name":"Command and Scripting Interpreter","domain":"ics","platforms":[],"environments":["ics-ot"],"source_url":"https://attack.mitre.org/techniques/T1701","technique_page":"techniques/ics/T1701/","page":"detections/ics/T1701/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0928","name":"Behavioral Detection of Command and Scripting Abuse in ICS","url":"https://attack.mitre.org/detectionstrategies/DET0928","stix_id":"x-mitre-detection-strategy--260bc795-4a3d-4ca6-8fd1-5e687112d20c","relationship_id":"relationship--330af428-95f6-4530-99ca-05bd00756b9f","description":"","analytics":[{"id":"AN2082","name":"Analytic 2082","guidance":"Real-time monitoring identifies a command-line interpreter (cmd.exe, PowerShell.exe) spawned as a child of an Industrial Control System (ICS) vendor application process, where this parent-child relationship is not part of the documented normal operation of that vendor software or directly spawned processes with a command line parameters containing ICS protocol/Application Programming Interface (API) interaction keywords, from a context not associated with documented automation scripts. Operational Technology (OT) operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.","url":"https://attack.mitre.org/detectionstrategies/DET0928#AN2082","platforms":["Windows"],"tuning":[{"field":"HighRiskCLICommands","description":"List of CLI command patterns considered high-risk warranting elevated scrutiny."},{"field":"LOLBinAbusePatterns","description":"Documented command-line argument patterns for living-off-the-land binary abuse."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN2082","source_url":"https://attack.mitre.org/detectionstrategies/DET0928#AN2082","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN2083","name":"Analytic 2083","guidance":"Real-time monitoring identifies a command and scripting interpreter process spawned by an Industrial Control System (ICS) service process, or interactive shell sessions from unexpected Secure Shell (SSH) source Internet Protocol (IP) addresses or an unexpected User Identifier (UID) not associated with recognized ICS automation scripts, deviating from the expected execution baseline. Operational Technology (OT) operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.","url":"https://attack.mitre.org/detectionstrategies/DET0928#AN2083","platforms":["Linux"],"tuning":[{"field":"HighRiskCLICommands","description":"List of CLI command patterns considered high-risk warranting elevated scrutiny."},{"field":"LOLBinAbusePatterns","description":"Documented command-line argument patterns for living-off-the-land binary abuse."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"syscall=execve; command or executable associated with the technique runs outside the approved ICS administrative/application baseline","platforms":["Linux"],"analytic_id":"AN2083","source_url":"https://attack.mitre.org/detectionstrategies/DET0928#AN2083","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN2084","name":"Analytic 2084","guidance":"Real-time monitoring identifies an Industrial Control System (ICS) network-device command-line interface (CLI) commands (e.g., interface shutdown, access control list modification, network address translation changes, etc.) from a source or account outside the approved network-management baseline or network traffic patterns consistent with scripted command execution -- regular-interval connections with consistent payload sizes -- to field device Internet Protocol (IP) addresses from a host not normally exhibiting such regularity. Operational Technology (OT) operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.","url":"https://attack.mitre.org/detectionstrategies/DET0928#AN2084","platforms":["Network Devices"],"tuning":[{"field":"HighRiskCLICommands","description":"List of CLI command patterns considered high-risk warranting elevated scrutiny."},{"field":"LOLBinAbusePatterns","description":"Documented command-line argument patterns for living-off-the-land binary abuse."}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"networkdevice:cli","channel":"shell command","platforms":["Network Devices"],"analytic_id":"AN2084","source_url":"https://attack.mitre.org/detectionstrategies/DET0928#AN2084","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]},{"id":"AN2085","name":"Analytic 2085","guidance":"Real-time monitoring identifies a session (Telnet, SSH, proprietary, etc.) opened to an embedded field device from a source not in the approved administrative CIDR, immediately followed by configuration-mode entry or high-risk commands (firmware operations, config write/erase, reload) or identifies sequences of Industrial Control System (ICS) protocol commands arriving at field devices that follow a scripted, deterministic pattern -- identical inter-command timing, systematic address iteration -- rather than the variable, operator-driven timing of legitimate engineering sessions. Operational Technology (OT) operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.","url":"https://attack.mitre.org/detectionstrategies/DET0928#AN2085","platforms":["Embedded"],"tuning":[{"field":"HighRiskCLICommands","description":"List of CLI command patterns considered high-risk warranting elevated scrutiny."},{"field":"LOLBinAbusePatterns","description":"Documented command-line argument patterns for living-off-the-land binary abuse."}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"device:cli","channel":"Shell command","platforms":["Embedded"],"analytic_id":"AN2085","source_url":"https://attack.mitre.org/detectionstrategies/DET0928#AN2085","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]}]}],"telemetry_references":[{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S1165","name":"FrostyGoop","url":"https://attack.mitre.org/software/S1165","kind":"malware","description":"[FrostyGoop](https://attack.mitre.org/software/S1165) is compiled for Windows systems and leverages a Windows-based command line interface.(Citation: Dragos FROSTYGOOP 2024) Modbus interaction functionality is based off a publicly available Github repository for command line input.(Citation: Nozomi BUSTLEBERM 2024)","relationship_id":"relationship--65b57405-c7f6-432b-83ac-9571563250db","references":[{"source_name":"Dragos FROSTYGOOP 2024","description":"Mark Graham, Carolyn Ahlers, Kyle O'Meara; Dragos. (2024, July). Impact of FrostyGoop ICS Malware on Connected OT Systems. Retrieved November 20, 2024.","url":"https://hub.dragos.com/hubfs/Reports/Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_r2.pdf"},{"source_name":"Nozomi BUSTLEBERM 2024","description":"Nozomi Networks Labs. (2024, July 24). Cyberwarfare Targeting OT: Protecting Against FrostyGoop/BUSTLEBERM Malware. Retrieved November 20, 2024.","url":"https://www.nozominetworks.com/blog/protecting-against-frostygoop-bustleberm-malware"}]}],"actors":[],"mitigations":[{"id":"M0938","name":"Execution Prevention","url":"https://attack.mitre.org/mitigations/M0938","kind":"course-of-action","description":"Execution prevention may block malicious software from accessing protected resources through the command-line interface.","relationship_id":"relationship--4c4fe037-c9ae-4f38-b717-901d3ce09528","references":[]},{"id":"M0942","name":"Disable or Remove Feature or Program","url":"https://attack.mitre.org/mitigations/M0942","kind":"course-of-action","description":"Consider removing or restricting features that are unnecessary to an asset's intended function within the control environment.","relationship_id":"relationship--9f5e8e35-663e-477b-86ab-75dfc9695ed8","references":[]},{"id":"M0948","name":"Application Isolation and Sandboxing","url":"https://attack.mitre.org/mitigations/M0948","kind":"course-of-action","description":"Consider the use of application isolation and sandboxing to restrict specific operating system interactions such as access through user accounts, services, system calls, registry, and network access. This may be even more useful in cases where the source of the executed script is unknown.","relationship_id":"relationship--92c8e2f2-0670-49a8-855c-4c5d1492fa36","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use a process simulator or isolated test rig with no connection to production controllers or physical actuators. Preserve safety interlocks; destructive effects require synthetic evidence, not real equipment damage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1701.003":"/ttp-simulation/techniques/ics/T1701.003/","T1701.002":"/ttp-simulation/techniques/ics/T1701.002/","T1701.001":"/ttp-simulation/techniques/ics/T1701.001/","T1701.005":"/ttp-simulation/techniques/ics/T1701.005/","T1701.006":"/ttp-simulation/techniques/ics/T1701.006/","T1701.004":"/ttp-simulation/techniques/ics/T1701.004/","T0886":"/ttp-simulation/techniques/ics/T0886/","T1701":"/ttp-simulation/techniques/ics/T1701/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"ics/T1701","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}