Procedure examples

Xbash can execute malicious JavaScript payloads on the victim’s machine.

NanHaiShu executes additional Jscript code on the victim's machine.

Latrodectus has used JavaScript files as part its infection chain during malicious spam
email campaigns.

Chaes has used JavaScript and Node.Js information stealer script that exfiltrates data using the node process.

Bundlore can execute JavaScript by injecting it into the victim's browser.

GlassWorm has leveraged JavaScript to execute its malicious code to include its hidden Unicode characters using the `eval` call. GlassWorm has also utilized encrypted payloads compiled in JavaScript.

Metamorfo includes payloads written in JavaScript.

KONNI has executed malicious JavaScript code.

BlackByte Ransomware is distributed as a JavaScript launcher file.

StrelaStealer has been distributed as a malicious JavaScript object.

WARPWIRE is a credential harvester written in JavaScript.

The Cobalt Strike System Profiler can use JavaScript to perform reconnaissance actions.

Valak can execute JavaScript containing configuration data for establishing persistence.

AshTag can use JSON files to deliver payloads and configuration files.

Shai-Hulud has used JavaScript to create JSON file output and run scripts using node.js.

POWERSTATS can use JavaScript code for execution.

Astaroth uses JavaScript to perform its core functionalities.

The QakBot web inject module can inject Java Script into web banking pages visited by the victim.

jRAT has been distributed as HTA files with JScript.

JSS Loader can download and execute JavaScript files.

XORIndex Loader has executed malicious JavaScript code.

evilginx2 can inject JavaScript code into HTML content to customize phishing attacks.

FRP can support the use of a JSON configuration file.

Remcos has the ability to execute JavaScript remotely.

Donut can generate shellcode outputs that execute via JavaScript or JScript.

TeamPCP Cloud Stealer has infected victims through malicious pre and post-install scripts within the package.json file.

Mini Shai-Hulud has leveraged JavaScript runtime to execute malicious scripts.

CanisterWorm can leverage stolen tokens to execute Javascsript (deploy.js) for self-propagation.

Kali365 has executed JavaScript within victims' browsers through a React frontend that detects browser sessions to evade automated analysis, auto-copies actor-generated device codes to the victim's clipboard, and polls the actor's C2 infrastructure every three seconds to confirm when OAuth token capture has completed..

Line Dancer can execute native commands in networking device command line interfaces.

PHASEJAM has leveraged native commands associated with the compromised network appliance to execute code.

DRYHOOK has the ability to interact with Ivanti Connect Secure environments and to modify system components.

Pacu leverages the AWS CLI for its operations.

TruffleHog has leveraged Cloud CLI in order to enumerate and gather credentials.

Lumma Stealer has utilized AutoIt malware scripts and AutoIt executables.

DarkGate uses AutoIt scripts dropped to a hidden directory during initial installation phases, such as `test.au3`.

XLoader can use an AutoIT script to decrypt a payload file, load it into victim memory, then execute it on the victim machine.

OutSteel was developed using the AutoIT scripting language.

Melcoz has been distributed through an AutoIt loader script.

Line Runner utilizes Lua scripts for command execution.

Remsec can use modules written in Lua for execution.

RedLine Stealer malware has leveraged Lua bytecode to perform malicious behavior.

EvilBunny has used Lua scripts to execute payloads.

PoetRAT has executed a Lua script through a Lua interpreter for Windows.

Cheerscrypt has leveraged `esxcli` in order to terminate running virtual machines.

VIRTUALPIE is capable of command line execution on compromised ESXi servers.

Royal ransomware uses `esxcli` to gather a list of running VMs and terminate them.

Mini Shai-Hulud has utilized the Docker command-line tool to gather details of the victim environment and collect credentials.

Stuxnet used MS10-073 and an undisclosed Task Scheduler vulnerability to escalate privileges on local Windows machines.

CosmicDuke attempts to exploit privilege escalation vulnerabilities CVE-2010-0232 or CVE-2010-4398.