Sub-technique of T1059 Command and Scripting Interpreter.View on attack.mitre.org
Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.
JScript is the Microsoft implementation of the same scripting standard. JScript is interpreted via the Windows Script engine and thus integrated with many components of Windows such as the Component Object Model and Internet Explorer HTML Application (HTA) pages.
JavaScript for Automation (JXA) is a macOS scripting language based on JavaScript, included as part of Apple’s Open Scripting Architecture (OSA), that was introduced in OSX 10.10. Apple’s OSA provides scripting capabilities to control applications, interface with the operating system, and bridge access into the rest of Apple’s internal APIs. As of OSX 10.10, OSA only supports two languages, JXA and AppleScript. Scripts can be executed via the command line utility osascript, they can be compiled into applications or script files via osacompile, and they can be compiled and executed in memory of other programs by leveraging the OSAKit Framework.
Adversaries may abuse various implementations of JavaScript to execute various behaviors. Common uses include hosting malicious scripts on websites as part of a Drive-by Compromise or downloading and executing these script files as secondary payloads. Since these payloads are text-based, it is also very common for adversaries to obfuscate their content as part of Obfuscated Files or Information.
Rules on DetectionCode tagged with T1059.007.
| Rule | Type | Risk | Data source |
|---|---|---|---|
| Cmdline Tool Not Executed In CMD Shell | TTP | NULL | Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 |
| Jscript Execution Using Cscript App | Anomaly | NULL | Sysmon EventID 1, CrowdStrike ProcessRollup2 |
| MacOS Osascript Executing JavaScript Code With ObjC | Anomaly | NULL | Osquery Results |
| MS Scripting Process Loading Ldap Module | Anomaly | NULL | Sysmon EventID 7 |
| MS Scripting Process Loading WMI Module | Anomaly | NULL | Sysmon EventID 7 |
| Windows Cmdline Tool Execution From Non-Shell Process | Anomaly | NULL | Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 |
| Windows GrimResource - MMC Process Accessing APDS DLL | TTP | NULL | Windows Event Log Security 4663 |
| Windows Node.exe Executing JS Script In Immediate Folder | TTP | NULL | Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 |
| Used by | Procedure example |
|---|---|
| GroupAPT-C-36 | APT-C-36 has used a fileless attack chain composed of three JavaScript code snippets to execute subsequent payloads. |
| GroupAPT32 | APT32 has used JavaScript for drive-by downloads and C2 communications. |
| GroupCobalt Group | Cobalt Group has executed JavaScript scriptlets on the victim's machine. |
| GroupContagious Interview | Contagious Interview has leveraged JavaScript in the execution of their downloader malware targeting Windows devices using a NodeJS script titled nvidia.js. |
| GroupEarth Lusca | Earth Lusca has manipulated legitimate websites to inject malicious JavaScript code as part of their watering hole operations. |
| GroupEvilnum | Evilnum has used malicious JavaScript files on the victim's machine. |
| GroupFIN6 | FIN6 has used malicious JavaScript to steal payment card data from e-commerce sites. |
| GroupFIN7 | FIN7 used JavaScript scripts to help perform tasks on the victim's machine. |
| Used by | Procedure example |
|---|---|
| MalwareAppleSeed | AppleSeed has the ability to use JavaScript to execute PowerShell. |
| MalwareAshTag | AshTag can use JSON files to deliver payloads and configuration files. |
| MalwareAstaroth | Astaroth uses JavaScript to perform its core functionalities. |
| MalwareAvaddon | Avaddon has been executed through a malicious JScript downloader. |
| MalwareBeaverTail | BeaverTail has executed malicious JavaScript code. BeaverTail has also been compiled with the Qt framework to execute in both Windows and macOS. ESET Contagious Interview BeaverTail InvisibleFerret February 2025Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024 |
| MalwareBlackByte Ransomware | BlackByte Ransomware is distributed as a JavaScript launcher file. |
| MalwareBundlore | Bundlore can execute JavaScript by injecting it into the victim's browser. |
| MalwareCanisterWorm | CanisterWorm can leverage stolen tokens to execute Javascsript (deploy.js) for self-propagation. |
| Used by | Procedure example |
|---|---|
| CampaignC0015 | During C0015, the threat actors used a malicious HTA file that contained a mix of encoded HTML and JavaScript/VBScript code. |
| CampaignC0017 | During C0017, APT41 deployed JScript web shells on compromised systems. |
| CampaignOperation Dust Storm | During Operation Dust Storm, the threat actors used JavaScript code. |
| CampaignPikabot Distribution February 2024 | Pikabot Distribution February 2024 utilized obfuscated JavaScript files for initial Pikabot payload download. |
| CampaignWater Curupira Pikabot Distribution | Water Curupira Pikabot Distribution initial delivery included obfuscated JavaScript objects stored in password-protected ZIP archives. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
