Check out the results from our first round of ATT&CK Evaluations at attackevals.mitre.org!

Scripting

Adversaries may use scripts to aid in operations and perform multiple actions that would otherwise be manual. Scripting is useful for speeding up operational tasks and reducing the time required to gain access to critical resources. Some scripting languages may be used to bypass process monitoring mechanisms by directly interacting with the operating system at an API level instead of calling other programs. Common scripting languages for Windows include VBScript and PowerShell but could also be in the form of command-line batch scripts.

Scripts can be embedded inside Office documents as macros that can be set to execute when files used in Spearphishing Attachment and other types of spearphishing are opened. Malicious embedded macros are an alternative means of execution than software exploitation through Exploitation for Client Execution, where adversaries will rely on macos being allowed or that the user will accept to activate them.

Many popular offensive frameworks exist which use forms of scripting for security testers and adversaries alike. [1] [1], [2] [2], and PowerSploit [3] are three examples that are popular among penetration testers for exploit and post-compromise operations and include many features for evading defenses. Some adversaries are known to use PowerShell. [4]

ID: T1064

Tactic: Defense Evasion, Execution

Platform:  Linux, macOS, Windows

Permissions Required:  User

Data Sources:  Process monitoring, File monitoring, Process command-line parameters

Defense Bypassed:  Process whitelisting, Data Execution Prevention, Exploit Prevention

Version: 1.0

Examples

NameDescription
APT1

APT1 has used batch scripting to automate execution of commands.[5]

APT19

APT19 downloaded and launched code within a SCT file.[6]

APT28

An APT28 loader Trojan uses a batch script to run its payload.[7]

APT29

APT29 has used encoded PowerShell scripts uploaded to CozyCar installations to download and install SeaDuke, as well as to evade defenses.[8][9]

APT3

APT3 has used PowerShell on victim systems to download and run payloads after exploitation.[10]

APT37

APT37 executes shellcode and a script to decode Base64 strings.[11]

Bisonal

Bisonal's dropper creates VBS scripts on the victim’s machine.[12]

BRONZE BUTLER

BRONZE BUTLER has used VBS, VBE, and batch scripts for execution.[13]

Cobalt Group

Cobalt Group has sent Word OLE compound documents with malicious obfuscated VBA macros that will run upon user execution. The group has also used an exploit toolkit known as Threadkit that launches .bat files.[14][15][16]

Cobalt Strike

Cobalt Strike can use PowerSploit or other scripting frameworks to perform execution.[17]

Comnie

Comnie executes BAT and VBS scripts.[18]

Dark Caracal

Dark Caracal has used macros in Word documents that would download a second stage if executed.[19]

DealersChoice

DealersChoice makes modifications to open-source scripts from GitHub and executes them on the victim’s machine.[20]

Deep Panda

Deep Panda has used PowerShell scripts to download and execute programs in memory, without writing to disk.[4]

Dragonfly 2.0

Dragonfly 2.0 used various types of scripting to perform operations, including Python and batch scripts. The group was observed installing Python 2.7 on a victim.[21][22]

FELIXROOT

FELIXROOT executes batch scripts on the victim’s machine.[23]

FIN10

FIN10 has executed malicious .bat files containing PowerShell commands.[24]

FIN5

FIN5 scans processes on all victim systems in the environment and uses automated scripts to pull back the results.[25]

FIN6

FIN6 has used a Metasploit PowerShell module to download and execute shellcode and to set up a local listener. FIN6 has also used scripting to iterate through a list of compromised PoS systems, copy data to a log file, and remove the original data files.[26]

FIN7

FIN7 used VBS and JavaScript scripts to help perform tasks on the victim's machine.[27]

FIN8

FIN8 has used a Batch file to automate frequently executed post compromise cleanup activities.[28]

Gamaredon Group

Gamaredon Group has used various batch scripts to establish C2, download additional files, and conduct other functions.[29]

Gorgon Group

Gorgon Group has used macros in Spearphishing Attachments as well as executed VBScripts on victim machines.[30]

Helminth

One version of Helminth consists of VBScript and PowerShell scripts. The malware also uses batch scripting.[31]

Honeybee

Honeybee embeds a Visual Basic script within a malicious Word document as part of initial access; the script is executed when the Word document is opened. The actors also used batch scripting.[32]

Ke3chang

Ke3chang has used batch scripts in its malware to install persistence mechanisms.[33]

Keydnap

Keydnap uses Python for scripting to execute additional commands.[34]

Koadic

Koadic performs most of its operations using Windows Script Host (Jscript and VBScript) and runs arbitrary shellcode .[35]

Lazarus Group

A Destover-like variant used by Lazarus Group uses a batch file mechanism to delete its binaries from the system.[36]

Leafminer

Leafminer infected victims using JavaScript code.[37]

Leviathan

Leviathan has used multiple types of scripting for execution, including JavaScript, JavaScript Scriptlets in XML, and VBScript.[38]

Magic Hound

Magic Hound malware has used .vbs scripts for execution.[39]

menuPass

menuPass has used malicious macros embedded inside Office documents to execute files.[40][41]

MoonWind

MoonWind uses batch scripts for various purposes, including to restart and uninstall itself.[42]

MuddyWater

MuddyWater has used VBScript and JavaScript files to execute its POWERSTATS payload.[43][44]

NanHaiShu

NanHaiShu executes additional Jscript and VBScript code on the victim's machine.[45]

NavRAT

NavRAT loads malicious shellcode and executes it in memory.[46]

OilRig

OilRig has used various types of scripting for execution, including .bat and .vbs scripts. The group has also used macros to deliver malware such as QUADAGENT and OopsIE.[47][48][49][50]

OopsIE

OopsIE creates and uses a VBScript as part of its persistent execution.[49][51]

Orz

Orz can execute commands with script as well as execute JavaScript.[38]

Patchwork

Patchwork used Visual Basic Scripts (VBS), JavaScript code, batch files, and .SCT files on victim machines.[52][53]

Proton

Proton uses macOS' .command file type to script actions.[54]

Proxysvc

Proxysvc uses a batch file to delete itself.[36]

Pupy

Pupy can use an add on feature when creating payloads that allows you to create custom Python scripts ("scriptlets") to perform tasks offline (without requiring a session) such as sandbox detection, adding persistence, etc.[55]

QUADAGENT

QUADAGENT uses VBScripts and batch scripts.[50]

Rancor

Rancor has used shell and VBS scripts as well as embedded macros for execution.[56]

RogueRobin

To assist in establishing persistence, RogueRobin creates %APPDATA%\OneDrive.bat and saves the following string to it:powershell.exe -WindowStyle Hidden -exec bypass -File "%APPDATA%\OneDrive.ps1".[57]

RunningRAT

RunningRAT uses a batch file to kill a security program task and then attempts to remove itself.[58]

SeaDuke

SeaDuke uses a module to execute Mimikatz with PowerShell to perform Pass the Ticket.[8]

Smoke Loader

Smoke Loader adds a Visual Basic script in the Startup folder to deploy the payload.[59]

Stealth Falcon

Stealth Falcon malware uses PowerShell and WMI to script data collection and command execution on the victim.[60]

TA459

TA459 has a VBScript for execution.[61]

TYPEFRAME

TYPEFRAME can uninstall malware components using a batch script. Additionally, a malicious Word document used for delivery uses VBA macros for execution.[62]

Mitigation

Turn off unused features or restrict access to scripting engines such as VBScript or scriptable administration frameworks such as PowerShell.

Configure Office security settings enable Protected View, to execute within a sandbox environment, and to block macros through Group Policy. [63] Other types of virtualization and application microsegmentation may also mitigate the impact of compromise. The risks of additional exploits and weaknesses in implementation may still exist. [64]

Detection

Scripting may be common on admin, developer, or power user systems, depending on job function. If scripting is restricted for normal users, then any attempts to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.

Scripts are likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for script execution and subsequent behavior. Actions may be related to network and system information Discovery, Collection, or other scriptable post-compromise behaviors and could be used as indicators of detection leading back to the source script.

Analyze Office file attachments for potentially malicious macros. Execution of macros may create suspicious process trees depending on what the macro is designed to do. Office processes, such as winword.exe, spawning instances of cmd.exe, script application like wscript.exe or powershell.exe, or other suspicious processes may indicate malicious activity. [65]

References

  1. Metasploit. (n.d.). Retrieved December 4, 2014.
  2. Veil Framework. (n.d.). Retrieved December 4, 2014.
  3. PowerSploit. (n.d.). Retrieved December 4, 2014.
  4. Alperovitch, D. (2014, July 7). Deep in Thought: Chinese Targeting of National Security Think Tanks. Retrieved November 12, 2014.
  5. Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.
  6. Ahl, I. (2017, June 06). Privileges and Credentials: Phished at the Request of Counsel. Retrieved May 17, 2018.
  7. Unit 42. (2017, December 15). Unit 42 Playbook Viewer. Retrieved December 20, 2017.
  8. Symantec Security Response. (2015, July 13). “Forkmeiamfamous”: Seaduke, latest weapon in the Duke armory. Retrieved July 22, 2015.
  9. Dunwoody, M. and Carr, N.. (2016, September 27). No Easy Breach DerbyCon 2016. Retrieved October 4, 2016.
  10. Moran, N., et al. (2014, November 21). Operation Double Tap. Retrieved January 14, 2016.
  11. Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.
  12. Hayashi, K., Ray, V. (2018, July 31). Bisonal Malware Used in Attacks Against Russia and South Korea. Retrieved August 7, 2018.
  13. Counter Threat Unit Research Team. (2017, October 12). BRONZE BUTLER Targets Japanese Enterprises. Retrieved January 4, 2018.
  14. Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.
  15. Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018.
  16. Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.
  17. Cobalt Strike. (2017, December 8). Tactics, Techniques, and Procedures. Retrieved December 20, 2017.
  18. Grunzweig, J. (2018, January 31). Comnie Continues to Target Organizations in East Asia. Retrieved June 7, 2018.
  19. Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.
  20. Falcone, R. (2018, March 15). Sofacy Uses DealersChoice to Target European Government Agency. Retrieved June 4, 2018.
  21. US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.
  22. US-CERT. (2017, October 20). Alert (TA17-293A): Advanced Persistent Threat Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved November 2, 2017.
  23. Patil, S. (2018, June 26). Microsoft Office Vulnerabilities Used to Distribute FELIXROOT Backdoor in Recent Campaign. Retrieved July 31, 2018.
  24. FireEye iSIGHT Intelligence. (2017, June 16). FIN10: Anatomy of a Cyber Extortion Operation. Retrieved June 25, 2017.
  25. Bromiley, M. and Lewis, P. (2016, October 7). Attacking the Hospitality and Gaming Industries: Tracking an Attacker Around the World in 7 Years. Retrieved October 6, 2017.
  26. FireEye Threat Intelligence. (2016, April). Follow the Money: Dissecting the Operations of the Cyber Crime Group FIN6. Retrieved June 1, 2016.
  27. Carr, N., et al. (2018, August 01). On the Hunt for FIN7: Pursuing an Enigmatic and Evasive Global Criminal Operation. Retrieved August 23, 2018.
  28. Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.
  29. Kasza, A. and Reichel, D.. (2017, February 27). The Gamaredon Group Toolset Evolution. Retrieved March 1, 2017.
  30. Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.
  31. Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017.
  32. Sherstobitoff, R. (2018, March 02). McAfee Uncovers Operation Honeybee, a Malicious Document Campaign Targeting Humanitarian Aid Groups. Retrieved May 16, 2018.
  33. Smallridge, R. (2018, March 10). APT15 is alive and strong: An analysis of RoyalCli and RoyalDNS. Retrieved April 4, 2018.
  1. Patrick Wardle. (2017, January 1). Mac Malware of 2016. Retrieved September 21, 2018.
  2. Magius, J., et al. (2017, July 19). Koadic. Retrieved June 18, 2018.
  3. Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.
  4. Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
  5. Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.
  6. Lee, B. and Falcone, R. (2017, February 15). Magic Hound Campaign Attacks Saudi Targets. Retrieved December 27, 2017.
  7. Accenture Security. (2018, April 23). Hogfish Redleaves Campaign. Retrieved July 2, 2018.
  8. Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.
  9. Miller-Osborn, J. and Grunzweig, J.. (2017, March 30). Trochilus and New MoonWind RATs Used In Attack Against Thai Organizations. Retrieved March 30, 2017.
  10. Singh, S. et al.. (2018, March 13). Iranian Threat Group Updates Tactics, Techniques and Procedures in Spear Phishing Campaign. Retrieved April 11, 2018.
  11. Villanueva, M., Co, M. (2018, June 14). Another Potential MuddyWater Campaign uses Powershell-based PRB-Backdoor. Retrieved July 3, 2018.
  12. F-Secure Labs. (2016, July). NANHAISHU RATing the South China Sea. Retrieved July 6, 2018.
  13. Mercer, W., Rascagneres, P. (2018, May 31). NavRAT Uses US-North Korea Summit As Decoy For Attacks In South Korea. Retrieved June 11, 2018.
  14. Sardiwal, M, et al. (2017, December 7). New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit. Retrieved December 20, 2017.
  15. Falcone, R. and Lee, B. (2017, July 27). OilRig Uses ISMDoor Variant; Possibly Linked to Greenbug Threat Group. Retrieved January 8, 2018.
  16. Lee, B., Falcone, R. (2018, February 23). OopsIE! OilRig Uses ThreeDollars to Deliver New Trojan. Retrieved July 16, 2018.
  17. Lee, B., Falcone, R. (2018, July 25). OilRig Targets Technology Service Provider and Government Agency with QUADAGENT. Retrieved August 9, 2018.
  18. Falcone, R., et al. (2018, September 04). OilRig Targets a Middle Eastern Government and Adds Evasion Techniques to OopsIE. Retrieved September 24, 2018.
  19. Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.
  20. Meltzer, M, et al. (2018, June 07). Patchwork APT Group Targets US Think Tanks. Retrieved July 16, 2018.
  21. Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.
  22. Nicolas Verdier. (n.d.). Retrieved January 29, 2018.
  23. Ash, B., et al. (2018, June 26). RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families. Retrieved July 2, 2018.
  24. Falcone, R., et al. (2018, July 27). New Threat Actor Group DarkHydrus Targets Middle East Government. Retrieved August 2, 2018.
  25. Sherstobitoff, R., Saavedra-Morales, J. (2018, February 02). Gold Dragon Widens Olympics Malware Attacks, Gains Permanent Presence on Victims’ Systems. Retrieved June 6, 2018.
  26. Hasherezade. (2016, September 12). Smoke Loader – downloader with a smokescreen still alive. Retrieved March 20, 2018.
  27. Marczak, B. and Scott-Railton, J.. (2016, May 29). Keep Calm and (Don’t) Enable Macros: A New Threat Actor Targets UAE Dissidents. Retrieved June 8, 2016.
  28. Axel F. (2017, April 27). APT Targets Financial Analysts with CVE-2017-0199. Retrieved February 15, 2018.
  29. US-CERT. (2018, June 14). MAR-10135536-12 – North Korean Trojan: TYPEFRAME. Retrieved July 13, 2018.
  30. Windows Defender Research. (2016, March 22). New feature in Office 2016 can block macros and help prevent infection. Retrieved April 11, 2018.
  31. Goodin, D. (2017, March 17). Virtual machine escape fetches $105,000 at Pwn2Own hacking contest - updated. Retrieved March 12, 2018.
  32. Felix. (2016, September). Analyzing Malicious Office Documents. Retrieved April 11, 2018.