1. Home
  2. ATT&CK Techniques
  3. T1059.007 JavaScript

T1059.007 JavaScript

Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.(Citation: NodeJS)

JScript is the Microsoft implementation of the same scripting standard. JScript is interpreted via the Windows Script engine and thus integrated with many components of Windows such as the Component Object Model and Internet Explorer HTML Application (HTA) pages.(Citation: JScrip May 2018)(Citation: Microsoft JScript 2007)(Citation: Microsoft Windows Scripts)

JavaScript for Automation (JXA) is a macOS scripting language based on JavaScript, included as part of Apple’s Open Scripting Architecture (OSA), that was introduced in OSX 10.10. Apple’s OSA provides scripting capabilities to control applications, interface with the operating system, and bridge access into the rest of Apple’s internal APIs. As of OSX 10.10, OSA only supports two languages, JXA and AppleScript. Scripts can be executed via the command line utility <code>osascript</code>, they can be compiled into applications or script files via <code>osacompile</code>, and they can be compiled and executed in memory of other programs by leveraging the OSAKit Framework.(Citation: Apple About Mac Scripting 2016)(Citation: SpecterOps JXA 2020)(Citation: SentinelOne macOS Red Team)(Citation: Red Canary Silver Sparrow Feb2021)(Citation: MDSec macOS JXA and VSCode)

Adversaries may abuse various implementations of JavaScript to execute various behaviors. Common uses include hosting malicious scripts on websites as part of a Drive-by Compromise or downloading and executing these script files as secondary payloads. Since these payloads are text-based, it is also very common for adversaries to obfuscate their content as part of Obfuscated Files or Information.

View in MITRE ATT&CK®

CRI Profile Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
PR.PS-05.02 Mobile code prevention Mitigates T1059.007 JavaScript
Comments
Mobile code procedures address specific actions taken to prevent the development, acquisition, and introduction of unacceptable mobile code within organizational systems, including requiring mobile code to be digitally signed by a trusted source.
References
    DE.CM-01.05 Website and service blocking Mitigates T1059.007 JavaScript
    Comments
    This diagnostic statement prevents adversaries from abusing various implementation of JavaScript for execution by blocking the execution of scripts and malicious code that pop up via adblockers and ads.
    References

      NIST 800-53 Mappings

      Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
      CA-07 Continuous Monitoring mitigates T1059.007 JavaScript
      CM-06 Configuration Settings mitigates T1059.007 JavaScript
      AC-17 Remote Access mitigates T1059.007 JavaScript
      SC-18 Mobile Code mitigates T1059.007 JavaScript
      SI-16 Memory Protection mitigates T1059.007 JavaScript
      RA-05 Vulnerability Monitoring and Scanning mitigates T1059.007 JavaScript
      CM-08 System Component Inventory mitigates T1059.007 JavaScript
      SI-10 Information Input Validation mitigates T1059.007 JavaScript
      SI-03 Malicious Code Protection mitigates T1059.007 JavaScript
      SI-07 Software, Firmware, and Information Integrity mitigates T1059.007 JavaScript
      CM-02 Baseline Configuration mitigates T1059.007 JavaScript
      CM-07 Least Functionality mitigates T1059.007 JavaScript
      SI-04 System Monitoring mitigates T1059.007 JavaScript
      AC-02 Account Management mitigates T1059.007 JavaScript
      AC-03 Access Enforcement mitigates T1059.007 JavaScript
      AC-06 Least Privilege mitigates T1059.007 JavaScript

      VERIS Mappings

      Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
      action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059.007 JavaScript

      GCP Mappings

      Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
      google_secops Google Security Operations technique_scores T1059.007 JavaScript
      Comments
      Google Security Ops triggers an alert based on webshell connections which are used to establish persistent access to a compromised machine [backdoor]. (e.g., `.*/config/keystore/.*\.js.*). This technique was scored as minimal based on low or uncertain detection coverage factor. https://github.com/chronicle/detection-rules/blob/783e0e5947774785db1c55041b70176deeca6f46/soc_prime_rules/proactive_exploit_detection/webserver/oracle_weblogic_exploit.yaral
      References
      1. ['https://cloud.google.com/security/products/security-operations'
      2. 'https://cloud.google.com/chronicle/docs/secops/secops-overview'
      3. 'https://github.com/chronicle/detection-rules']

      AWS Mappings

      Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
      aws_web_application_firewall AWS Web Application Firewall technique_scores T1059.007 JavaScript
      Comments
      The AWS WAF protects web applications from injection attacks that leverage command and scripting interpreters. AWS WAF provides this protection via the following rule sets that block malicious traffic across a variety of operating systems and applications. AWSManagedRulesCommonRuleSet AWSManagedRulesSQLiRuleSet AWSManagedRulesUnixRuleSet AWSManagedRulesWindowsRuleSet AWSManagedRulesPHPRuleSet AWSManagedRulesWordPressRuleSet This is given a score of Significant because it provides protections for PowerShell, Unix, and JavaScript command and scripting interpreters by blocking the malicious content in near real-time.
      References