From enterprise
Jump to: navigation, search
ID T1064
Tactic Defense Evasion, Execution
Platform Linux, macOS, Windows
Data Sources Process monitoring, File monitoring, Process command-line parameters
Defense Bypassed Process whitelisting

Adversaries may use scripts to aid in operations and perform multiple actions that would otherwise be manual. Scripting is useful for speeding up operational tasks and reducing the time required to gain access to critical resources. Some scripting languages may be used to bypass process monitoring mechanisms by directly interacting with the operating system at an API level instead of calling other programs. Common scripting languages for Windows include VBScript and PowerShell but could also be in the form of command-line batch scripts.

Many popular offensive frameworks exist which use forms of scripting for security testers and adversaries alike. Metasploit1, Veil2, and PowerSploit3 are three examples that are popular among penetration testers for exploit and post-compromise operations and include many features for evading defenses. Some adversaries are known to use PowerShell.4


  • APT1 has used batch scripting to automate execution of commands.5
  • APT29 has used encoded PowerShell scripts uploaded to CozyCar installations to download and install SeaDuke, as well as to evade defenses.67
  • APT3 has used PowerShell on victim systems to download and run payloads after exploitation.8
  • APT34 has used .bat and .vbs scripts for execution.9
  • BRONZE BUTLER has used VBS, VBE, and batch scripts for execution.10
  • Deep Panda has used PowerShell scripts to download and execute programs in memory, without writing to disk.4
  • Dragonfly used various scripts for execution, and was observed installing Python 2.7 on a victim.11
  • FIN10 has executed malicious .bat files containing PowerShell commands.12
  • FIN5 scans processes on all victim systems in the environment and uses automated scripts to pull back the results.13
  • FIN6 has used a Metasploit PowerShell module to download and execute shellcode and to set up a local listener. FIN6 has also used scripting to iterate through a list of compromised PoS systems, copy data to a log file, and remove the original data files.14
  • Gamaredon Group has used various batch scripts to establish C2, download additional files, and conduct other functions.15
  • Magic Hound malware has used .vbs scripts for execution.16
  • OilRig has used various types of scripting for execution, including.17
  • Stealth Falcon malware uses PowerShell and WMI to script data collection and command execution on the victim.18
  • Cobalt Strike can use PowerSploit or other scripting frameworks to perform execution.19
  • One version of Helminth consists of VBScript and PowerShell scripts. The malware also uses batch scripting.20
  • MoonWind uses batch scripts for various purposes, including to restart and uninstall itself.21
  • SeaDuke uses a module to execute Mimikatz with PowerShell to perform Pass the Ticket.6


Turn off unused features or restrict access to scripting engines such as VBScript or scriptable administration frameworks such as PowerShell.


Scripting may be common on admin, developer, or power user systems, depending on job function. If scripting is restricted for normal users, then any attempts to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.

Scripts are likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for script execution and subsequent behavior. Actions may be related to network and system information Discovery, Collection, or other scriptable post-compromise behaviors and could be used as indicators of detection leading back to the source script.