Procedure examples

PACEMAKER can use a simple bash script for execution.

Bundlore has leveraged /bin/sh and /bin/bash to execute commands on the victim machine.

BPFDoor can create a reverse shell and supports vt100 emulator formatting.

Derusbi is capable of creating a remote Bash shell and executing commands.

Drovorub can execute arbitrary commands as root on a compromised system.

PULSECHECK can use Unix shell script for command execution.

Kobalos can spawn a new pseudo-terminal and execute arbitrary commands at the command prompt.

OSX_OCEANLOTUS.D uses a shell script as the main executable inside an app bundle and drops an embedded base64-encoded payload to the /tmp folder.

NKAbuse is initially installed and executed through an initial shell script.

MacMa can execute supplied shell commands and uses bash scripts to perform additional actions.

Proton uses macOS' .command file type to script actions.

CallMe has the capability to create a reverse shell on victims.

RIFLESPINE can execute commands with `/bin/sh`.

CoinTicker executes a bash script to establish a reverse shell.

Penquin can execute remote commands using bash scripts.

Ebury can use the commands `Xcsh` or `Xcls` to open a shell with Ebury level permissions and `Xxsh` to open a shell with root level.

Kinsing has used Unix shell scripts to execute commands in the victim environment.

PITSTOP has the ability to receive shell commands over a Unix domain socket.

ZIPLINE can use `/bin/sh` to create a reverse shell and execute commands.

Shai-Hulud has utilized Linux shell commands to modify configuration files.

VIRTUALPITA has the ability to spawn a bash shell for script execution.

XCSSET uses a shell script to execute Mach-o files and osacompile commands such as, osacompile -x -o xcode.app main.applescript.

AppleJeus has used shell scripts to execute commands after installation and set persistence mechanisms.

CookieMiner has used a Unix shell script to run a series of commands targeting macOS.

OSX/Shlayer can use bash scripts to check the macOS version, download payloads, and extract bytes from files. OSX/Shlayer uses the command sh -c tail -c +1381... to extract bytes at an offset from a specified file. OSX/Shlayer uses the curl -fsL "$url" >$tmp_path command to download malicious payloads into a temporary directory.

LoudMiner used shell scripts to launch various services and to start/stop the QEMU virtualization.

TeamPCP Cloud Stealer has abused the shell script files entrypoint.sh (in trivy-action) and setup.sh (in ast-github-action/2.3.28) for discovery and credential harvesting.

CanisterWorm has used shell commands to enable and start the malicious systemd service for execution and persistence.

Bumblebee can create a Visual Basic script to enable persistence.

Exaramel for Windows has a command to execute VBS scripts on the victim’s machine.

Smoke Loader adds a Visual Basic script in the Startup folder to deploy the payload.

TAMECAT has used VBScript to query anti-virus products.

Ursnif droppers have used VBA macros to download and execute the malware's full executable payload.

NETWIRE has been executed through use of VBScripts.

Emotet has sent Microsoft Word documents with embedded macros that will invoke scripts to download additional payloads.

SystemBC has leveraged VBScript to execute malicious code.

Squirrelwaffle has used malicious VBA macros in Microsoft Word documents and Excel spreadsheets that execute an `AutoOpen` subroutine.

ShrinkLocker is a VisualBasic script (VBS) object that calls multiple other operating system functions during execution.

Snip3 can use visual basic scripts for first-stage execution.

WhisperGate can use a Visual Basic script to exclude the `C:\` drive from Windows Defender.

Mispadu’s dropper uses VBS files to install payloads and perform execution.

IcedID has used obfuscated VBA string expressions.

PowerShower has the ability to save and execute VBScript.

CHIMNEYSWEEP has executed a script named cln.vbs on compromised hosts.

Flagpro can execute malicious VBA macros embedded in .xlsm files.

KeyBoy uses VBS scripts for installing files and performing execution.

Pteranodon can use a malicious VBS file for execution.

ROKRAT has used Visual Basic for execution.

Javali has used embedded VBScript to download malicious payloads from C2.

Bisonal's dropper creates VBS scripts on the victim’s machine.