Scripting

APT1 has used batch scripting to automate execution of commands.^[5]

APT19 downloaded and launched code within a SCT file.^[6]

An APT28 loader Trojan uses a batch script to run its payload.^[7]

APT29 has used encoded PowerShell scripts uploaded to CozyCar installations to download and install SeaDuke, as well as to evade defenses.^[8][9]

APT3 has used PowerShell on victim systems to download and run payloads after exploitation.^[10]

APT37 executes shellcode and a script to decode Base64 strings.^[11]

Bisonal's dropper creates VBS scripts on the victim’s machine.^[12]

BRONZE BUTLER has used VBS, VBE, and batch scripts for execution.^[13]

Cobalt Group has sent Word OLE compound documents with malicious obfuscated VBA macros that will run upon user execution. The group has also used an exploit toolkit known as Threadkit that launches .bat files.^[14][15][16]

Cobalt Strike can use PowerSploit or other scripting frameworks to perform execution.^[17]

Comnie executes BAT and VBS scripts.^[18]

Dark Caracal has used macros in Word documents that would download a second stage if executed.^[19]

DealersChoice makes modifications to open-source scripts from GitHub and executes them on the victim’s machine.^[20]

Deep Panda has used PowerShell scripts to download and execute programs in memory, without writing to disk.^[4]

Dragonfly 2.0 used various types of scripting to perform operations, including Python and batch scripts. The group was observed installing Python 2.7 on a victim.^[21][22]

FELIXROOT executes batch scripts on the victim’s machine.^[23]

FIN10 has executed malicious .bat files containing PowerShell commands.^[24]

FIN5 scans processes on all victim systems in the environment and uses automated scripts to pull back the results.^[25]

FIN6 has used a Metasploit PowerShell module to download and execute shellcode and to set up a local listener. FIN6 has also used scripting to iterate through a list of compromised PoS systems, copy data to a log file, and remove the original data files.^[26]

FIN7 used VBS and JavaScript scripts to help perform tasks on the victim's machine.^[27]

FIN8 has used a Batch file to automate frequently executed post compromise cleanup activities.^[28]

Gamaredon Group has used various batch scripts to establish C2, download additional files, and conduct other functions.^[29]

Gorgon Group has used macros in Spearphishing Attachments as well as executed VBScripts on victim machines.^[30]

One version of Helminth consists of VBScript and PowerShell scripts. The malware also uses batch scripting.^[31]

Honeybee embeds a Visual Basic script within a malicious Word document as part of initial access; the script is executed when the Word document is opened. The actors also used batch scripting.^[32]

Ke3chang has used batch scripts in its malware to install persistence mechanisms.^[33]

Keydnap uses Python for scripting to execute additional commands.^[34]

Koadic performs most of its operations using Windows Script Host (Jscript and VBScript) and runs arbitrary shellcode .^[35]

A Destover-like variant used by Lazarus Group uses a batch file mechanism to delete its binaries from the system.^[36]

Leafminer infected victims using JavaScript code.^[37]

Leviathan has used multiple types of scripting for execution, including JavaScript, JavaScript Scriptlets in XML, and VBScript.^[38]

Magic Hound malware has used .vbs scripts for execution.^[39]

menuPass has used malicious macros embedded inside Office documents to execute files.^[40][41]

MoonWind uses batch scripts for various purposes, including to restart and uninstall itself.^[42]

MuddyWater has used VBScript and JavaScript files to execute its POWERSTATS payload.^[43][44]

NanHaiShu executes additional Jscript and VBScript code on the victim's machine.^[45]

NavRAT loads malicious shellcode and executes it in memory.^[46]

OilRig has used various types of scripting for execution, including .bat and .vbs scripts. The group has also used macros to deliver malware such as QUADAGENT and OopsIE.^{[47][48][49][50]}

OopsIE creates and uses a VBScript as part of its persistent execution.^[49][51]

Orz can execute commands with script as well as execute JavaScript.^[38]

Patchwork used Visual Basic Scripts (VBS), JavaScript code, batch files, and .SCT files on victim machines.^[52][53]

Proton uses macOS' .command file type to script actions.^[54]

Proxysvc uses a batch file to delete itself.^[36]

Pupy can use an add on feature when creating payloads that allows you to create custom Python scripts ("scriptlets") to perform tasks offline (without requiring a session) such as sandbox detection, adding persistence, etc.^[55]

QUADAGENT uses VBScripts and batch scripts.^[50]

Rancor has used shell and VBS scripts as well as embedded macros for execution.^[56]

To assist in establishing persistence, RogueRobin creates %APPDATA%\OneDrive.bat and saves the following string to it:powershell.exe -WindowStyle Hidden -exec bypass -File "%APPDATA%\OneDrive.ps1".^[57]

RunningRAT uses a batch file to kill a security program task and then attempts to remove itself.^[58]

SeaDuke uses a module to execute Mimikatz with PowerShell to perform Pass the Ticket.^[8]

Smoke Loader adds a Visual Basic script in the Startup folder to deploy the payload.^[59]

Stealth Falcon malware uses PowerShell and WMI to script data collection and command execution on the victim.^[60]

TA459 has a VBScript for execution.^[61]

TYPEFRAME can uninstall malware components using a batch script. Additionally, a malicious Word document used for delivery uses VBA macros for execution.^[62]