T1059.005 Visual Basic — Attack Simulation

Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows technologies such as Component Object Model and the Native API through the Windows API. Although tagged as legacy with no planned future evolutions, VB is integrated and supported in the .NET Framework and cross-platform .NET Core. Derivative languages based on VB have also been created, such as Visual…

Technique description

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

Visual Basic script execution to gather local computer information
windows automated powershell
Procedure 1620de42-160a-4fe5-bbaf-d3fef0181ce9; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
Extract Memory via VBA
windows automated powershell
Procedure 8faff437-a114-4547-9a60-749652a03df6; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
Encoded VBS code execution
windows automated powershell
Procedure e8209d5f-e42d-45e6-9c2f-633ac4f1eefa; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.

Connected ecosystem references

Linked tags

enterprise cloud-hosted-endpoint onprem Linux macOS Windows execution isolated_authorized_lab procedure_review_required telemetry_configuration_required

can_simulate subtechnique source_mapped

Detection and collection

T1059.005 detection workspace

Attack tools

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.