| ID | Name |
|---|---|
| T1701.001 | PowerShell |
| T1701.002 | Windows Command Shell |
| T1701.003 | Unix Shell |
| T1701.004 | Visual Basic |
| T1701.005 | Python |
| T1701.006 | JavaScript |
Adversaries may abuse various implementations of JavaScript for execution. JavaScript is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JavaScript can be executed in runtime environments outside the browser.[1]
JScript is the Microsoft implementation of the same scripting standard. JScript is interpreted via the Windows Script engine and thus integrated with many components of Windows such as the Component Object Model and Internet Explorer HTML Application (HTA) pages.[2][3][4]
Adversaries may abuse various implementations of JavaScript to execute various behaviors. Common uses include hosting malicious scripts on websites as part of a Drive-by Compromise or downloading and executing these script files as secondary payloads. Since these payloads are text-based, it is also very common for adversaries to obfuscate their content as part of Obfuscated Files or Information.
Within industrial control system networks, adversaries most commonly abuse the use of JavaScript on overlap assets that run on operating system platforms similar to Enterprise devices.
| ID | Name | Description |
|---|---|---|
| S0496 | REvil |
REvil utilizes JavaScript, WScript, and PowerShell scripts to execute. The malicious JavaScript attachment has an obfuscated PowerShell script that executes the malware. [5] |
| ID | Mitigation | Description |
|---|---|---|
| M0942 | Disable or Remove Feature or Program |
Disable or remove JavaScript/JScript execution surfaces that are not required for the documented role of an ICS asset, while preserving validated HMI, vendor, and engineering dependencies. |
| M0938 | Execution Prevention |
Use application control to restrict wscript.exe, cscript.exe, mshta.exe, Node.js, and other JavaScript runtimes to approved paths, parent processes, scripts, and users. |
| M0950 | Exploit Protection |
Harden browsers, HTML applications, and Windows scripting hosts that can execute JavaScript/JScript on ICS overlap assets. |
| M0921 | Restrict Web-Based Content |
Restrict untrusted web content and active scripting on ICS workstations, jump hosts, and other overlap assets, especially where browser access is not required for operations. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0936 | Behavioral Detection of JavaScript Execution in ICS | AN2092 |
Real-time monitoring identifies wscript.exe/cscript.exe/mshta.exe or other JScript execution from unexpected parents/paths, especially when followed by child interpreters, network connections, or system modification. Alert only when the interpreter is not part of the asset's approved software/automation baseline or its execution context violates an approved signer/hash/path/parent/user rule, and require OT-relevant corroboration such as access to engineering files, ICS software/API use, communications with protected OT assets, configuration change, or another suspicious follow-on behavior. Suppress documented vendor software, engineering workflows, diagnostics, backup, patching, and approved maintenance. |
| AN2093 |
Real-time monitoring identifies node/nodejs or another JavaScript runtime launched from an unexpected service, web process, scheduled task, user, or path, followed by outbound connections, shell execution, persistence, or OT-relevant access. Alert only when the interpreter/shell is not expected for the asset role or user/service context, or when its parent, path, arguments, remote-session source, or follow-on behavior violates the approved OT baseline. Suppress approved engineering scripts, vendor support, diagnostics, backup, patching, and maintenance windows. |