Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.
There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic.
Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services in order to achieve remote Execution.[1][2][3]
Threat groups89th percentile · 88% of ATT&CK techniques have fewer threat groups attributed.
4
CampaignsTop 10%
Campaigns90th percentile · 88% of ATT&CK techniques have fewer campaigns recorded.
23
Tools & malwareTop 15%
Tools & malware85th percentile · 84% of ATT&CK techniques have fewer tools implementing them.
148
Detection rulesTop 1%
Detection rules99th percentile · 99% of ATT&CK techniques have fewer detection rules written.
Command and Scripting Interpreter MITRE reference T1059
Top 11%of all ATT&CK techniques for number of groups
17 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Has executed PHP and Shell scripts to identify and infect subsequent routers for the ORB network.1
2019–2024
All 4 campaigns for this technique
23 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Command and Scripting Interpreter detection strategy DET0516
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Behavioral Detection of Command and Scripting Interpreter Abuse
Enterprise
5 platforms
AN1428 · Windows
Detects the execution of scripting or command interpreters (e.g., powershell.exe, cmd.exe, wscript.exe) outside expected administrative time windows or from abnormal user contexts, often followed by encoded/obfuscated arguments or secondary execution events.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
CommandLinePattern
Tunable to match encoded or uncommon script execution patterns specific to the environment.
ParentProcessName
May vary across managed/unmanaged workstations or user-driven script activity.
TimeWindow
Used to restrict analysis to work hours or known admin maintenance windows.
AN1429 · Linux
Detects use of shell interpreters (e.g., bash, sh, python, perl) initiated by users or processes not normally executing them, especially when chaining suspicious utilities like netcat, curl, or ssh.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
InterpreterName
Regex to identify which interpreters (bash, python, ruby) to monitor based on typical usage.
UserContext
Scope to users or service accounts not expected to run interpreters interactively.
ExecutionChainLength
Defines maximum process tree depth to correlate interpreter execution with its effects.
AN1430 · macOS
Detects launch of command-line interpreters via Terminal, Automator, or hidden osascript, especially when parent process lineage deviates from user-initiated applications.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
ShellEnabledFlag
Control alerting based on whether ESXi shell access is typically disabled.
SSHContext
Scope detection to SSH session origins or internal vs. remote access.
AN1432 · Network Devices
Identifies CLI interpreter access (e.g., Cisco IOS, Juniper JUNOS) via enable mode or scripting-capable sessions used by uncommon accounts or from unknown IPs.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
UserRole
Which roles or privilege levels should be monitored for interpreter misuse.
DeviceType
Support filtering for routers, switches, firewalls depending on network segmentation.
1 analytic
Often, after a threat actor gains access to a system, they will attempt to run some kind of malware to further infect the victim machine. These malware often have long command line strings, which could be a possible indicator of attack. Here, we use sysmon and Splunk to first find the average command string length and search for command strings that stretch over multiple lines, thus identifying anomalies and possibly malicious commands.
TypeAnomalyCoverageLowSubmitted2020
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
This is a Splunk query that determines the average length of a command per user and searches for a command string that is multiple times longer than the average length
index=* sourcetype="xmlwineventlog" EventCode=4688 |eval cmd_len=len(CommandLine) | eventstats avg(cmd_len) as avg by host| stats max(cmd_len) as maxlen, values(avg) as avgperhost by host, CommandLine | where maxlen > 10*avgperhost
On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent Visual Basic and JavaScript scripts from executing potentially malicious downloaded content .
Use application control where appropriate. For example, PowerShell Constrained Language mode can be used to restrict access to sensitive or otherwise dangerous language elements such as those used to execute arbitrary Windows APIs or files (e.g., Add-Type).
When PowerShell is necessary, consider restricting PowerShell execution policy to administrators. Be aware that there are methods of bypassing the PowerShell execution policy, depending on environment configuration.
PowerShell JEA (Just Enough Administration) may also be used to sandbox administration and limit what commands admins/users can execute through remote PowerShell sessions.
Script blocking extensions can help prevent the execution of scripts and HTA files that may commonly be used during the exploitation process. For malicious code served up through ads, adblockers can help prevent that code from executing in the first place.
Tests1Executorspowershell 1Need elevation0 of 1Have prerequisites1Have cleanup0Platformswindows
#
Test
Platform
Executor
Elevation
Prereqs
Cleanup
Ref
01
AutoIt Script Execution
windows
powershell
—
1
—
An adversary may attempt to execute suspicious or malicious script using AutoIt software instead of regular terminal like powershell or cmd. Calculator will popup when the script is executed successfully.
This analytic detects suspicious python package installations where the package name resembles popular Python libraries but may be typosquatted or slightly altered. (...)
The following analytic detects file downloads involving executable, archive, or scripting-related file types that are commonly used in malware delivery. (...)
This analytic detects HTTP requests to privileged execution paths on Cisco routers, specifically targeting the `/level/15/exec/-/*` endpoint using Cisco Secure Firewall Intrusion Events. (...)
Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indicative of potential code injection activity.
Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. (...)
Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. (...)
Detects unusual domain resolutions originating from CScript/WScript that can identify malicious javascript files executing in an environment, often as a result from a phishing or watering hole attack.
This detection looks for reverse shell string patterns on an ESXi host, which may indicate that a threat actor is attempting to establish remote control over the system.
Detects Stracciatella which executes a Powershell runspace from within C# (aka SharpPick technique) with AMSI, ETW and Script Block Logging disabled based on PE metadata characteristics.
Detects suspicious child processes spawned from Node.js server processes on Linux systems, potentially indicating remote code execution exploitation such as CVE-2025-55182 (React2Shell). (...)
The following correlation identifies multiple risk events associated with the "Living Off The Land" analytic story, indicating potentially suspicious behavior. (...)
The following analytic identifies potential exploitation of Log4Shell CVE-2021-44228 by correlating multiple MITRE ATT&CK tactics detected in risk events. (...)
This detection identifies potential prompt injection attempts within MCP (Model Context Protocol) communications by monitoring for known malicious phrases and patterns commonly used to manipulate AI assistants. (...)
Detects a potentially suspicious execution of a parent process located in the "\Users\Public" folder executing a child process containing references to shell or scripting binaries and commandlines.
Detects the modification of NTFS symbolic link behavior using fsutil, which could be used to enable remote to local or remote to remote symlinks for potential attacks.
Moriarty Meng (idea), Anton Kutepov (rule), oscd.community
2020-10-17
2021-11-27
c83bf4b5-cdf0-437c-90fa-43d734f7c476
Detects suspicious script execution from suspicious directories or folders accessible by environment variables that may indicate malware activity. (...)
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
2024-08-29
—
8737b7f6-8df3-4bb7-b1da-06019b99b687
Splunk
The following analytic detects the execution of the socat utility with command-line arguments that configure a TCP or OpenSSL listener and bind an executable to incoming connections. (...)
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
2024-09-02
—
8c1a5675-cb85-452f-a298-b01b22a51856
Detects the execution of a shell as sub process of "rsync" without the expected command line flag "-e" being used, which could be an indication of exploitation as described in CVE-2024-12084. (...)
The following analytic detects path traversal command-line execution, often used in malicious documents to execute code via msdt.exe for defense evasion. (...)
The following analytic identifies instances where four or more distinct detection analytics are associated with malicious command line behavior on a specific host. (...)
This detection searches for ASR audit events that are generated when a process or application attempts to perform an action that would be blocked by an ASR rule, but is allowed to proceed for auditing purposes.
This detection searches for ASR block events that are generated when a process or application attempts to perform an action that is blocked by an ASR rule. (...)
The following analytic identifies security events from Microsoft Defender, focusing on Exploit Guard and Attack Surface Reduction (ASR) features. (...)
The following analytic identifies a process command line referencing the IronLanguages GitHub repository, which hosts .NET implementation of popular scripting engines. (...)
The following analytic identifies a Windows command interpreter process being executed where it's process name does not match it's original file name attribute. (...)
The following analytic detects when the Task Scheduler service ("svchost.exe -k netsvcs -p -s Schedule") spawns common command line, scripting, or shell execution binaries such as "powershell.exe" or "cmd.exe". (...)
Detects suspicious child processes started by Node.js server processes on Windows, which may indicate exploitation of vulnerabilities like CVE-2025-55182 (React2Shell). (...)
The following analytic identifies child processes spawned by vmtoolsd.exe, the VMWare Tools service in Windows, which typically runs with SYSTEM privileges. (...)