Home
ATT&CK Techniques
T1059 Command and Scripting Interpreter

T1059 Command and Scripting Interpreter Mappings

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.

There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic.

Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services in order to achieve remote Execution.(Citation: Powershell Remote Commands)(Citation: Cisco IOS Software Integrity Assurance - Command History)(Citation: Remote Shell Execution in Python)

View in MITRE ATT&CK®

Mappings

Capability ID	Capability Description	Mapping Type	ATT&CK ID	ATT&CK Name
AC-17	Remote Access	Protects	T1059	Command and Scripting Interpreter
AC-02	Account Management	Protects	T1059	Command and Scripting Interpreter
AC-03	Access Enforcement	Protects	T1059	Command and Scripting Interpreter
AC-05	Separation of Duties	Protects	T1059	Command and Scripting Interpreter
AC-06	Least Privilege	Protects	T1059	Command and Scripting Interpreter
CA-07	Continuous Monitoring	Protects	T1059	Command and Scripting Interpreter
CA-08	Penetration Testing	Protects	T1059	Command and Scripting Interpreter
CM-11	User-installed Software	Protects	T1059	Command and Scripting Interpreter
CM-02	Baseline Configuration	Protects	T1059	Command and Scripting Interpreter
CM-05	Access Restrictions for Change	Protects	T1059	Command and Scripting Interpreter
CM-06	Configuration Settings	Protects	T1059	Command and Scripting Interpreter
CM-07	Least Functionality	Protects	T1059	Command and Scripting Interpreter
CM-08	System Component Inventory	Protects	T1059	Command and Scripting Interpreter
IA-02	Identification and Authentication (organizational Users)	Protects	T1059	Command and Scripting Interpreter
IA-08	Identification and Authentication (non-organizational Users)	Protects	T1059	Command and Scripting Interpreter
IA-09	Service Identification and Authentication	Protects	T1059	Command and Scripting Interpreter
RA-05	Vulnerability Monitoring and Scanning	Protects	T1059	Command and Scripting Interpreter
SC-18	Mobile Code	Protects	T1059	Command and Scripting Interpreter
SI-10	Information Input Validation	Protects	T1059	Command and Scripting Interpreter
SI-16	Memory Protection	Protects	T1059	Command and Scripting Interpreter
SI-02	Flaw Remediation	Protects	T1059	Command and Scripting Interpreter
SI-03	Malicious Code Protection	Protects	T1059	Command and Scripting Interpreter
SI-04	System Monitoring	Protects	T1059	Command and Scripting Interpreter
SI-07	Software, Firmware, and Information Integrity	Protects	T1059	Command and Scripting Interpreter
PUR-AS-E5	Audit Solutions	Technique Scores	T1059	Command and Scripting Interpreter
EOP-Antimalware-E3	Antimalware	Technique Scores	T1059	Command and Scripting Interpreter
ME-RBAC-E3	Role Based Access Control	Technique Scores	T1059	Command and Scripting Interpreter
M365-DEF-ZAP-E3	Zero Hour Auto Purge	Technique Scores	T1059	Command and Scripting Interpreter
DEF-IR-E5	Incident Response	Technique Scores	T1059	Command and Scripting Interpreter
PUR-PAM-E5	Privileged Access Management	Technique Scores	T1059	Command and Scripting Interpreter

ATT&CK Subtechniques

Technique ID	Technique Name	Number of Mappings
T1059.007	JavaScript	16
T1059.002	AppleScript	16
T1059.009	Cloud API	14
T1059.008	Network Device CLI	15
T1059.001	PowerShell	21
T1059.004	Unix Shell	11
T1059.006	Python	17
T1059.003	Windows Command Shell	11
T1059.005	Visual Basic	17