Scripting

APT1 has used batch scripting to automate execution of commands.^[76]

APT19 downloaded and launched code within a SCT file.^[85]

An APT28 loader Trojan uses a batch script to run its payload. The group has also used macros to execute payloads.^{[107][27][108][109]}

APT29 has used encoded PowerShell scripts uploaded to CozyCar installations to download and install SeaDuke, as well as to evade defenses.^[32][69]

APT3 has used PowerShell on victim systems to download and run payloads after exploitation.^[84]

APT32 has used macros, PowerShell scripts, COM scriptlets, and VBS scripts.^[110][40]

APT37 executes shellcode and a script to decode Base64 strings.^[99]

APT39 utilized custom scripts to perform internal reconnaissance.^[118]

Astaroth uses JavaScript to perform its core functionalities.^[49]

Bisonal's dropper creates VBS scripts on the victim’s machine.^[16]

BRONZE BUTLER has used VBS, VBE, and batch scripts for execution.^[92]

China Chopper's server component is a text based payload available in a variety of scripting languages. ^[52]

Cobalt Group has sent Word OLE compound documents with malicious obfuscated VBA macros that will run upon user execution and executed JavaScript scriptlets on the victim's machine. The group has also used an exploit toolkit known as Threadkit that launches .bat files.^{[101][102][103][104][105][106]}

Cobalt Strike can use PowerShell, Python, VBA, PowerSploit, other scripting frameworks to perform execution.^[5][6]

CoinTicker executes a bash script to establish a reverse shell and a Python script to download its second stage.^[53]

Comnie executes BAT and VBS scripts.^[14]

Dark Caracal has used macros in Word documents that would download a second stage if executed.^[70]

DarkComet can execute various types of scripts on the victim’s machine.^[28]

Darkhotel has dropped an mspaint.lnk shortcut to disk which launches a shell script that downloads and executes a file.^[100]

DealersChoice makes modifications to open-source scripts from GitHub and executes them on the victim’s machine.^[17]

Deep Panda has used PowerShell scripts to download and execute programs in memory, without writing to disk.^[4]

Denis executes shellcode on the victim's machine.^[40]

Dragonfly 2.0 used various types of scripting to perform operations, including Python and batch scripts. The group was observed installing Python 2.7 on a victim.^[87][88]

Emotet has sent Microsoft Word documents with embedded macros that will invoke scripts to download additional payloads.^{[42][43][44][45][46]}

Empire has modules for executing scripts.^[10]

EvilBunny has an integrated scripting engine to download and execute Lua scripts.^[65]

Exaramel for Windows has a command to execute VBS and GO scripts on the victim’s machine.^[20]

FELIXROOT executes batch scripts on the victim’s machine.^[35]

FIN10 has executed malicious .bat files containing PowerShell commands.^[83]

FIN4 has used VBA macros to display a dialog box and collect victim credentials.^[111][112]

FIN5 scans processes on all victim systems in the environment and uses automated scripts to pull back the results.^[95]

FIN6 has used a Metasploit PowerShell module to download and execute shellcode and to set up a local listener. FIN6 has also used scripting to iterate through a list of compromised PoS systems, copy data to a log file, and remove the original data files.^[90][91]

FIN7 used SQL, VBS and JavaScript scripts to help perform tasks on the victim's machine.^[115][62]

FIN8 has used a Batch file to automate frequently executed post compromise cleanup activities.^[86]

Gallmaker used PowerShell scripts for execution.^[116]

Gamaredon Group has used various batch scripts to establish C2, download additional files, and conduct other functions.^[97]

Gorgon Group has used macros in Spearphishing Attachments as well as executed VBScripts on victim machines.^[117]

One version of Helminth consists of VBScript and PowerShell scripts. The malware also uses batch scripting.^[37]

HiddenWasp uses a script to automate tasks on the victim's machine and to assist in execution.^[64]

Honeybee embeds a Visual Basic script within a malicious Word document as part of initial access; the script is executed when the Word document is opened. The actors also used batch scripting.^[89]

JCry has used VBS scripts.^[61]

JHUHUGIT uses a .bat file to execute a .dll.^[27]

jRAT has been distributed as HTA files with VBScript+JScript.^[54]

Ke3chang has used batch scripts in its malware to install persistence mechanisms.^[98]

KeyBoy uses Python and VBS scripts for installing files and performing execution.^[60]

Keydnap uses Python for scripting to execute additional commands.^[22]

Koadic performs most of its operations using Windows Script Host (Jscript and VBScript) and runs arbitrary shellcode .^[8]

A Destover-like variant used by Lazarus Group uses a batch file mechanism to delete its binaries from the system.^[13]

Leafminer infected victims using JavaScript code.^[93]

Leviathan has used multiple types of scripting for execution, including JavaScript, JavaScript Scriptlets in XML, and VBScript.^[31]

Machete uses Python scripts. ^[67][68]

Machete used multiple compiled Python scripts on the victim’s system.^[124]

Magic Hound malware has used .vbs scripts for execution.^[71]

menuPass has used malicious macros embedded inside Office documents to execute files.^[81][82]

MoonWind uses batch scripts for various purposes, including to restart and uninstall itself.^[11]

MuddyWater has used VBScript and JavaScript files to execute its POWERSTATS payload. MuddyWater has also used Microsoft scriptlets, macros, and PowerShell scripts.[^{[72][73][74][75][21]}

NanHaiShu executes additional Jscript and VBScript code on the victim's machine.^[33]

NanoCore uses VBS and JavaScript files.^[29]

NavRAT loads malicious shellcode and executes it in memory.^[36]

OceanSalt has been executed via malicious macros.^[41]

OilRig has used various types of scripting for execution, including .bat and .vbs scripts. The group has also used macros to deliver malware such as QUADAGENT and OopsIE.^{[78][79][25][18][80]}

OopsIE creates and uses a VBScript as part of its persistent execution.^[25][26]

Orz can execute commands with script as well as execute JavaScript.^[31]

OSX/Shlayer can use bash scripts to check the macOS version and download payloads.^[66]

OSX_OCEANLOTUS.D uses macros for execution as well as VBS and PowerShell scripts.^[39]

Patchwork used Visual Basic Scripts (VBS), JavaScript code, batch files, and .SCT files on victim machines.^[113][114]

PowerStallion uses PowerShell loops to iteratively check for available commands in its OneDrive C2 server.^[63]

POWERSTATS can use VBScript (VBE), PowerShell, and JavaScript code for execution.^[21]

Proton uses macOS' .command file type to script actions.^[34]

Proxysvc uses a batch file to delete itself.^[13]

PUNCHBUGGY has used PowerShell, python, and shellcode scripts.^[59]

Pupy can use an add on feature when creating payloads that allows you to create custom Python scripts ("scriptlets") to perform tasks offline (without requiring a session) such as sandbox detection, adding persistence, etc.^[7]

QUADAGENT uses VBScripts and batch scripts.^[18]

Rancor has used shell and VBS scripts as well as embedded macros for execution.^[94]

Remcos uses Python scripts.^[9]

Remexi uses AutoIt and VBS scripts throughout its execution process.^[51]

Revenge RAT executes scripts on the victim's machine.^[55][56]

To assist in establishing persistence, RogueRobin creates %APPDATA%\OneDrive.bat and saves the following string to it:powershell.exe -WindowStyle Hidden -exec bypass -File "%APPDATA%\OneDrive.ps1". RogueRobin also uses Windows Script Components.^[23][24]

RunningRAT uses a batch file to kill a security program task and then attempts to remove itself.^[12]

SamSam uses custom batch scripts to execute some of its components.^[48]

SeaDuke uses a module to execute Mimikatz with PowerShell to perform Pass the Ticket.^[32]

Silence has used JS, VBS, and PowerShell scripts.^[120]

Smoke Loader adds a Visual Basic script in the Startup folder to deploy the payload.^[38]

SpeakUp uses Perl and Python scripts.^[50]

SQLRat has used SQL to execute JavaScript and VB scripts on the host system.^[62]

Stealth Falcon malware uses PowerShell and WMI to script data collection and command execution on the victim.^[77]

StoneDrill has several VBS scripts used throughout the malware's lifecycle. ^[57]

TA459 has a VBScript for execution.^[96]

TA505 has used PowerShell, VBS, and JavaScript for code execution.^[121][122]

TrickBot has used macros in Excel documents to download and deploy the malware on the user’s machine.^[47]

Turla has used PowerShell and VBS scripts throughout its operations. ^[123]

TYPEFRAME can uninstall malware components using a batch script. Additionally, a malicious Word document used for delivery uses VBA macros for execution.^[19]

Ursnif droppers have used VBA macros and PowerShell to download and execute the malware's full executable payload.^[58]

WIRTE has used VBS and PowerShell scripts throughout its operation. ^[119]

Xbash can execute malicious JavaScript and VBScript payloads on the victim’s machine.^[30]

Zeus Panda can launch remote scripts on the victim’s machine.^[15]

Configure Office security settings enable Protected View, to execute within a sandbox environment, and to block macros through Group Policy. Other types of virtualization and application microsegmentation may also mitigate the impact of compromise.

Turn off unused features or restrict access to scripting engines such as VBScript or scriptable administration frameworks such as PowerShell.