Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.[1]
28 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Has used the MeshCentral command-line interface utility meshctrl.js and npm to interact with compromised systems. Specifically for npm, ShinyHunters has checked for the authenticode tool using the command npm list global authenticode.1 Additionally, ShinyHunters has used the MeshCentral command to execute the propagation script: node meshctrl.js RunCommand --loginuser admin --loginpass '[password]' --id '[agent_id]' --run 'bash /tmp/[victim_abbreviation]_fanout.sh' .1
Has used the JavaScript runtime for malware delivery and injected malicious JavaScript into OpenVSX extensions.12
Has leveraged JavaScript in the execution of their downloader malware targeting Windows devices using a NodeJS script titled nvidia.js.1
Has used JavaScript files in malware execution chains.1
Has used JavaScript to execute additional malicious payloads.1
Delivered malicious JavaScript to exploit targets when exploiting Roundcube Webmail servers.1
All 28 groups for this technique · 6 newest in this preview
5 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Utilized obfuscated JavaScript files for initial Pikabot payload download.1
Initial delivery included obfuscated JavaScript objects stored in password-protected ZIP archives.1
During C0015, the threat actors used a malicious HTA file that contained a mix of encoded HTML and JavaScript/VBScript code.1
During C0017, APT41 deployed JScript web shells on compromised systems.1
During Operation Dust Storm, the threat actors used JavaScript code.1
All 5 campaigns for this technique
42 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Has executed JavaScript within victims' browsers through a React frontend that detects browser sessions to evade automated analysis, auto-copies actor-generated device codes to the victim's clipboard, and polls the actor's C2 infrastructure every three seconds to confirm when OAuth token capture has completed..123
Has leveraged JavaScript runtime to execute malicious scripts.12
Can leverage stolen tokens to execute Javascsript (deploy.js) for self-propagation.1
Has infected victims through malicious pre and post-install scripts within the package.json file.1
Has the ability to run JavaScript code from the C2 server. Additionally, Tsundere Botnet has used Node.js to execute JavaScript code for the loader component.1
Can use JSON files to deliver payloads and configuration files.1
All 42 software entries for this technique · 6 newest in this preview
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
AN0733 · Windows
Detects JavaScript execution through WSH (wscript.exe, cscript.exe) or HTA (mshta.exe), particularly when spawned from Office macros, web browsers, or abnormal user paths. Correlates script execution with outbound network activity or system modification.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Module LoadDC0016 | WinEventLog:Sysmon | EventCode=7 |
| Script ExecutionDC0029 | m365:defender | ScriptBlockLogging + AMSI |
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ParentProcess | Execution of wscript.exe, cscript.exe, or mshta.exe from suspicious parent like Excel or Outlook. |
| ScriptPath | Script loaded from %TEMP%, user download folder, or via UNC/web path. |
| TimeWindow | Execution of JavaScript during non-business or patch windows. |
| UserContext | Execution by accounts not typically authorized for scripting (e.g., non-admin users). |
| EntropyScore | Obfuscated JS with high entropy detected by AMSI or ScriptBlock logging. |
AN0734 · macOS
Detects JavaScript for Automation (JXA) via osascript or compiled scripts using OSAKit APIs. Flags execution involving system modification, inter-process scripting, or browser abuse.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Script ExecutionDC0029 | macos:unifiedlog | log stream with predicate 'eventMessage CONTAINS "osascript"' |
| Process CreationDC0032 | macos:osquery | process_events |
| Command ExecutionDC0064 | macos:syslog | /var/log/system.log |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ScriptLocation | Execution of JXA from user-controlled paths like ~/Downloads or /Volumes. |
| ParentProcess | osascript invoked by third-party apps (VSCode, browsers, etc.). |
| APIInvocation | Use of OSAKit API by apps not typically scripting-enabled. |
AN0735 · Linux
Detects Node.js or JavaScript interpreter execution from web shells, cron jobs, or local users. Correlates execution with reverse shell behavior, file modifications, or abnormal outbound connections.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Script ExecutionDC0029 | linux:syslog | /var/log/syslog |
| Process CreationDC0032 | auditd:SYSCALL | execve |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ScriptPath | Script launched from /tmp, /var/tmp, or hidden dot directories. |
| BinaryName | Custom compiled JS binaries like node_shell or interpreter disguises. |
| UserExecutionContext | Execution by service accounts or low-privilege users running cron scripts. |
| NetworkFollowUp | Connection attempts to C2 post-node.js execution. |
On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent JavaScript scripts from executing potentially malicious downloaded content .
Turn off or restrict access to unneeded scripting components.
Denylist scripting where appropriate.
Script blocking extensions can help prevent the execution of JavaScript and HTA files that may commonly be used during the exploitation process. For malicious code served up through ads, adblockers can help prevent that code from executing in the first place.
Tests from Atomic Red Team (MIT licence) · technique definition
34 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|