Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Command and Scripting Interpreter

Sub-techniques (8)

ID	Name
.001	PowerShell
.002	AppleScript
.003	Windows Command Shell
.004	Unix Shell
.005	Visual Basic
.006	Python
.007	JavaScript
.008	Network Device CLI

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell. There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic. Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services in order to achieve remote Execution.(Citation: Powershell Remote Commands)(Citation: Cisco IOS Software Integrity Assurance - Command History)(Citation: Remote Shell Execution in Python)

ID: T1059

Sub-techniques: .001 .002 .003 .004 .005 .006 .007 .008

Tactic(s): Execution

Platforms: Linux, macOS, Network, Windows

Data Sources: Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution

Version: 2.3

Created: 31 May 2017

Last Modified: 19 Apr 2022

Name	Description
Procedure Examples
Fox Kitten	Fox Kitten has used a Perl reverse shell to communicate with C2.(Citation: ClearSky Pay2Kitten December 2020)
Stealth Falcon	Stealth Falcon malware uses WMI to script data collection and command execution on the victim.(Citation: Citizen Lab Stealth Falcon May 2016)
FIN7	FIN7 used SQL scripts to help perform tasks on the victim's machine.(Citation: FireEye FIN7 Aug 2018)(Citation: Flashpoint FIN 7 March 2019)(Citation: FireEye FIN7 Aug 2018)
DarkComet	DarkComet can execute various types of scripts on the victim’s machine.(Citation: Malwarebytes DarkComet March 2018)
FIN6	FIN6 has used scripting to iterate through a list of compromised PoS systems, copy data to a log file, and remove the original data files.(Citation: FireEye FIN6 April 2016)(Citation: FireEye FIN6 Apr 2019)
Melcoz	Melcoz has been distributed through an AutoIt loader script.(Citation: Securelist Brazilian Banking Malware July 2020)
	For Operation Spalax, the threat actors used Nullsoft Scriptable Install System (NSIS) scripts to install malware.(Citation: ESET Operation Spalax Jan 2021)
CHOPSTICK	CHOPSTICK is capable of performing remote command execution.(Citation: Crowdstrike DNC June 2016)(Citation: ESET Sednit Part 2)
Donut	Donut can generate shellcode outputs that execute via Ruby.(Citation: Donut Github)
FIVEHANDS	FIVEHANDS can receive a command line argument to limit file encryption to specified directories.(Citation: FireEye FiveHands April 2021)(Citation: NCC Group Fivehands June 2021)
FIN5	FIN5 scans processes on all victim systems in the environment and uses automated scripts to pull back the results.(Citation: Mandiant FIN5 GrrCON Oct 2016)
Matryoshka	Matryoshka is capable of providing Meterpreter shell access.(Citation: ClearSky Wilted Tulip July 2017)
Imminent Monitor	Imminent Monitor has a CommandPromptPacket and ScriptPacket module(s) for creating a remote shell and executing scripts.(Citation: QiAnXin APT-C-36 Feb2019)
Kessel	Kessel can create a reverse shell between the infected host and a specified system.(Citation: ESET ForSSHe December 2018)
APT19	APT19 downloaded and launched code within a SCT file.(Citation: FireEye APT19)
gh0st RAT	gh0st RAT is able to open a remote shell to execute commands.(Citation: FireEye Hacking Team)(Citation: Nccgroup Gh0st April 2018)
Molerats	Molerats used various implants, including those built on .NET, on target machines.(Citation: Kaspersky MoleRATs April 2019)
APT32	APT32 has used COM scriptlets to download Cobalt Strike beacons.(Citation: Cybereason Cobalt Kitty 2017)
Dragonfly	Dragonfly has used the command line for execution.(Citation: US-CERT TA18-074A)
P.A.S. Webshell	P.A.S. Webshell has the ability to create reverse shells with Perl scripts.(Citation: ANSSI Sandworm January 2021)
WINERACK	WINERACK can create a reverse shell that utilizes statically-linked Wine cmd.exe code to emulate Windows command prompt commands.(Citation: FireEye APT37 Feb 2018)
Bandook	Bandook can support commands to execute Java-based payloads.(Citation: CheckPoint Bandook Nov 2020)
Whitefly	Whitefly has used a simple remote shell tool that will call back to the C2 server and wait for commands.(Citation: Symantec Whitefly March 2019)
Zeus Panda	Zeus Panda can launch remote scripts on the victim’s machine.(Citation: GDATA Zeus Panda June 2017)
SpeakUp	SpeakUp uses Perl scripts.(Citation: CheckPoint SpeakUp Feb 2019)
APT39	APT39 has utilized AutoIt and custom scripts to perform internal reconnaissance.(Citation: FireEye APT39 Jan 2019)(Citation: FBI FLASH APT39 September 2020)
Ke3chang	Malware used by Ke3chang can run commands on the command-line interface.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: NCC Group APT15 Alive and Strong)
APT37	APT37 has used Ruby scripts to execute payloads.(Citation: Volexity InkySquid RokRAT August 2021)
Windigo	Windigo has used a Perl script for information gathering.(Citation: ESET ForSSHe December 2018)
Get2	Get2 has the ability to run executables with command-line arguments.(Citation: Proofpoint TA505 October 2019)
Dragonfly 2.0	Dragonfly 2.0 used command line for execution.(Citation: US-CERT TA18-074A)
PoetRAT	PoetRAT has executed a Lua script through a Lua interpreter for Windows.(Citation: Talos PoetRAT October 2020)
OilRig	OilRig has used various types of scripting for execution.(Citation: FireEye APT34 Dec 2017)(Citation: OilRig ISMAgent July 2017)(Citation: Unit 42 OopsIE! Feb 2018)(Citation: Unit 42 QUADAGENT July 2018)(Citation: Unit42 OilRig Nov 2018)
Empire	Empire uses a command-line interface to interact with systems.(Citation: Github PowerShell Empire)
Bonadan	Bonadan can create bind and reverse shells on the infected system.(Citation: ESET ForSSHe December 2018)

Mitigation	Description
Mitigations
Code Signing	Enforce binary and application integrity with digital signature verification to prevent untrusted code from executing.
Disable or Remove Feature or Program	Remove or deny access to unnecessary and potentially vulnerable software to prevent abuse by adversaries.
Execution Prevention	Block execution of code on a system through application control, and/or script blocking.
Antivirus/Antimalware	Use signatures or heuristics to detect malicious software.
Privileged Account Management	Manage the creation, modification, use, and permissions associated to privileged accounts, including SYSTEM and root.
Restrict Web-Based Content	Restrict use of certain websites, block downloads/attachments, block Javascript, restrict browser extensions, etc.
Behavior Prevention on Endpoint	Use capabilities to prevent suspicious behavior patterns from occurring on endpoint systems. This could include suspicious process, file, API call, etc. behavior.

Detection

Command-line and scripting activities can be captured through proper logging of process execution with command-line arguments. This information can be useful in gaining additional insight to adversaries' actions through how they use native processes or custom tools. Also monitor for loading of modules associated with specific languages. If scripting is restricted for normal users, then any attempt to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent. Scripts are likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for script execution and subsequent behavior. Actions may be related to network and system information discovery, collection, or other scriptable post-compromise behaviors and could be used as indicators of detection leading back to the source script.

References

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.