Procedure examples

Anchor can execute payloads via shell scripting.

PACEMAKER can use a simple bash script for execution.

Bundlore has leveraged /bin/sh and /bin/bash to execute commands on the victim machine.

BPFDoor can create a reverse shell and supports vt100 emulator formatting.

Derusbi is capable of creating a remote Bash shell and executing commands.

Drovorub can execute arbitrary commands as root on a compromised system.

PULSECHECK can use Unix shell script for command execution.

Kobalos can spawn a new pseudo-terminal and execute arbitrary commands at the command prompt.

OSX_OCEANLOTUS.D uses a shell script as the main executable inside an app bundle and drops an embedded base64-encoded payload to the /tmp folder.

NKAbuse is initially installed and executed through an initial shell script.

MacMa can execute supplied shell commands and uses bash scripts to perform additional actions.

Proton uses macOS' .command file type to script actions.

CallMe has the capability to create a reverse shell on victims.

RIFLESPINE can execute commands with `/bin/sh`.

CoinTicker executes a bash script to establish a reverse shell.

Penquin can execute remote commands using bash scripts.

Ebury can use the commands `Xcsh` or `Xcls` to open a shell with Ebury level permissions and `Xxsh` to open a shell with root level.

Kinsing has used Unix shell scripts to execute commands in the victim environment.

PITSTOP has the ability to receive shell commands over a Unix domain socket.

ZIPLINE can use `/bin/sh` to create a reverse shell and execute commands.

Shai-Hulud has utilized Linux shell commands to modify configuration files.

VIRTUALPITA has the ability to spawn a bash shell for script execution.

XCSSET uses a shell script to execute Mach-o files and osacompile commands such as, osacompile -x -o xcode.app main.applescript.

AppleJeus has used shell scripts to execute commands after installation and set persistence mechanisms.

CookieMiner has used a Unix shell script to run a series of commands targeting macOS.

OSX/Shlayer can use bash scripts to check the macOS version, download payloads, and extract bytes from files. OSX/Shlayer uses the command sh -c tail -c +1381... to extract bytes at an offset from a specified file. OSX/Shlayer uses the curl -fsL "$url" >$tmp_path command to download malicious payloads into a temporary directory.

LoudMiner used shell scripts to launch various services and to start/stop the QEMU virtualization.

TeamPCP Cloud Stealer has abused the shell script files entrypoint.sh (in trivy-action) and setup.sh (in ast-github-action/2.3.28) for discovery and credential harvesting.

CanisterWorm has used shell commands to enable and start the malicious systemd service for execution and persistence.

TeamPCP has leveraged malware capable of execution via the Linux CLI.

During Operation Dream Job, Lazarus Group executed a VBA written malicious macro after victims download malicious DOTM files; Lazarus Group also used Visual Basic macro code to extract a double Base64 encoded DLL implant.

During Frankenstein, the threat actors used Word documents that prompted the victim to enable macros and run a Visual Basic script.

During Operation Sharpshooter, the threat actors used a VBA macro to execute a simple downloader that installed Rising Sun.

For Operation Honeybee, the threat actors used a Visual Basic script embedded within a Word document to download an implant.

During Operation Dust Storm, the threat actors used Visual Basic scripts.

During the 2015 Ukraine Electric Power Attack, Sandworm Team installed a VBA script called `vba_macro.exe`. This macro dropped `FONTCACHE.DAT`, the primary BlackEnergy implant; `rundll32.exe`, for executing the malware; `NTUSER.log`, an empty file; and desktop.ini, the default file used to determine folder displays on Windows machines.

During C0015, the threat actors used a malicious HTA file that contained a mix of HTML and JavaScript/VBScript code.

During Juicy Mix, OilRig used VBS droppers to deliver and establish persistence for the Mango backdoor.

For the SolarWinds Compromise, APT29 wrote malware such as Sibot in Visual Basic.

During Operation AkaiRyū, MirrorFace used Word templates containing VBA code for malware execution.

During FunnyDream, the threat actors used a Visual Basic script to run remote commands.

During Operation CuckooBees, the threat actors executed an encoded VBScript file using `wscript` and wrote the decoded output to a text file.

During Outer Space, OilRig used VBS droppers to deploy malware.

During the 2016 Ukraine Electric Power Attack, Sandworm Team created VBScripts to run on an SSH server.

During Operation Wocao, threat actors used VBScript to conduct reconnaissance on targeted systems.

For C0011, Transparent Tribe used malicious VBA macros within a lure document as part of the Crimson malware installation process onto a compromised host.

APT38 has used VBScript to execute commands and other operational tasks.

SideCopy has sent Microsoft Office Publisher documents to victims that have embedded malicious macros that execute an hta file via calling `mshta.exe`.

Kimsuky has used Visual Basic to download malicious payloads. Kimsuky has also used malicious VBA macros within maldocs disguised as forms that trigger when a victim types any content into the lure. Kimsuky has also leveraged VBScript (VBS) scripts to execute temp.vbs every 19 minutes using a scheduled task to run QuasarRAT.

Patchwork used Visual Basic Scripts (VBS) on victim machines.