| ID | Name |
|---|---|
| T1701.001 | PowerShell |
| T1701.002 | Windows Command Shell |
| T1701.003 | Unix Shell |
| T1701.004 | Visual Basic |
| T1701.005 | Python |
| T1701.006 | JavaScript |
Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows technologies such as Component Object Model and the Native API through the Windows API. Although tagged as legacy with no planned future evolutions, VB is integrated and supported in the .NET Framework and cross-platform .NET Core.[1][2]
Derivative languages based on VB have also been created, such as Visual Basic for Applications (VBA) and VBScript. VBA is an event-driven programming language built into Microsoft Office, as well as several third-party applications.[3][4] VBA enables documents to contain macros used to automate the execution of tasks and other functionality on the host. VBScript is a default scripting language on Windows hosts and can also be used in place of JavaScript on HTML Application (HTA) webpages served to Internet Explorer (though most modern browsers do not come with VBScript support).[5]
Adversaries may use VB payloads to execute malicious commands. Common malicious usage includes automating execution of behaviors with VBScript or embedding VBA content into Spearphishing Attachment payloads (which may also involve Mark-of-the-Web Bypass to enable execution).
Within industrial control system networks, adversaries may abuse the use of VB and VBScript on overlap assets that run on Microsoft Windows operating systems, especially in cases where legacy versions are still used in operations (Workstations, Data Historians, Human Machine Interfaces, Application Servers, Jump Hosts, etc.).
| ID | Name | Description |
|---|---|---|
| C0025 | 2016 Ukraine Electric Power Attack |
During the 2016 Ukraine Electric Power Attack, Sandworm Team utilized VBS and batch scripts for file movement and as wrappers for PowerShell execution.[6] |
| C0034 | 2022 Ukraine Electric Power Attack |
During the 2022 Ukraine Electric Power Attack, Sandworm Team utilizes a Visual Basic script |
| G0049 | OilRig |
OilRig has embedded a macro within spearphishing attachments that has been made up of both a VBScript and a PowerShell script.[8] |
| ID | Mitigation | Description |
|---|---|---|
| M0949 | Antivirus/Antimalware |
Apply exploit-protection controls to Windows applications capable of invoking VBA/VBScript, particularly Office and legacy applications present on ICS overlap assets, after compatibility testing. |
| M0942 | Disable or Remove Feature or Program |
Disable Windows Script Host, Office macro capability, or other VB execution surfaces only on ICS assets where they are not required by validated vendor or engineering workflows. |
| M0938 | Execution Prevention |
Use application control and macro/script restrictions to prevent unapproved VBS/VBA/VBScript execution, while explicitly allowlisting required vendor macros and engineering automation. |
| M0950 | Exploit Protection |
Harden applications that can host or launch VB/VBA/VBScript content and reduce exposed script-host execution paths where operationally feasible. |
| M0921 | Restrict Web-Based Content |
Limit retrieval and execution of untrusted web or document-based active content on ICS workstations and jump hosts, especially where those systems can reach control assets. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0932 | Behavioral Detection of Visual Basic Execution in ICS | AN2091 |
Real-time monitoring identifies wscript.exe/cscript.exe, Office macro, or HTA-driven Visual Basic execution from unexpected parents/paths or followed by PowerShell, command shell, network activity, or system modification. Alert only when the interpreter is not part of the asset's approved software/automation baseline or its execution context violates an approved signer/hash/path/parent/user rule, and require OT-relevant corroboration such as access to engineering files, ICS software/API use, communications with protected OT assets, configuration change, or another suspicious follow-on behavior. Suppress documented vendor software, engineering workflows, diagnostics, backup, patching, and approved maintenance. |