Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Command and Scripting Interpreter: JavaScript

Other sub-techniques of Command and Scripting Interpreter (8)

ID	Name
.001	PowerShell
.002	AppleScript
.003	Windows Command Shell
.004	Unix Shell
.005	Visual Basic
.006	Python
.007	JavaScript
.008	Network Device CLI

Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.(Citation: NodeJS) JScript is the Microsoft implementation of the same scripting standard. JScript is interpreted via the Windows Script engine and thus integrated with many components of Windows such as the Component Object Model and Internet Explorer HTML Application (HTA) pages.(Citation: JScrip May 2018)(Citation: Microsoft JScript 2007)(Citation: Microsoft Windows Scripts) JavaScript for Automation (JXA) is a macOS scripting language based on JavaScript, included as part of Apple’s Open Scripting Architecture (OSA), that was introduced in OSX 10.10. Apple’s OSA provides scripting capabilities to control applications, interface with the operating system, and bridge access into the rest of Apple’s internal APIs. As of OSX 10.10, OSA only supports two languages, JXA and AppleScript. Scripts can be executed via the command line utility osascript, they can be compiled into applications or script files via osacompile, and they can be compiled and executed in memory of other programs by leveraging the OSAKit Framework.(Citation: Apple About Mac Scripting 2016)(Citation: SpecterOps JXA 2020)(Citation: SentinelOne macOS Red Team)(Citation: Red Canary Silver Sparrow Feb2021)(Citation: MDSec macOS JXA and VSCode) Adversaries may abuse various implementations of JavaScript to execute various behaviors. Common uses include hosting malicious scripts on websites as part of a Drive-by Compromise or downloading and executing these script files as secondary payloads. Since these payloads are text-based, it is also very common for adversaries to obfuscate their content as part of Obfuscated Files or Information.

ID: T1059.007

Sub-technique of: T1059

Tactic(s): Execution

Platforms: Linux, macOS, Windows

Permissions Required: Administrator, SYSTEM, User

Data Sources: Command: Command Execution, Module: Module Load, Process: Process Creation, Script: Script Execution

Version: 2.1

Created: 23 Jun 2020

Last Modified: 16 Aug 2021

Name	Description
Procedure Examples
AppleSeed	AppleSeed has the ability to use JavaScript to execute PowerShell.(Citation: Malwarebytes Kimsuky June 2021)
Cobalt Strike	The Cobalt Strike System Profiler can use JavaScript to perform reconnaissance actions.(Citation: Talos Cobalt Strike September 2020)
Metamorfo	Metamorfo includes payloads written in JavaScript.(Citation: Medium Metamorfo Apr 2020)
Turla	Turla has used various JavaScript-based backdoors.(Citation: ESET Turla Mosquito Jan 2018)
APT32	APT32 has used JavaScript for drive-by downloads and C2 communications.(Citation: Cybereason Cobalt Kitty 2017)(Citation: Volexity Ocean Lotus November 2020)
NanHaiShu	NanHaiShu executes additional Jscript code on the victim's machine.(Citation: fsecure NanHaiShu July 2016)
FIN6	FIN6 has used malicious JavaScript to steal payment card data from e-commerce sites.(Citation: Trend Micro FIN6 October 2019)
Sidewinder	Sidewinder has used JavaScript to drop and execute malware loaders.(Citation: ATT Sidewinder January 2021)(Citation: Rewterz Sidewinder COVID-19 June 2020)
QakBot	The QakBot web inject module can inject Java Script into web banking pages visited by the victim.(Citation: Kaspersky QakBot September 2021)
Avaddon	Avaddon has been executed through a malicious JScript downloader.(Citation: Hornet Security Avaddon June 2020)(Citation: Awake Security Avaddon)
MuddyWater	MuddyWater has used JavaScript files to execute its POWERSTATS payload.(Citation: ClearSky MuddyWater Nov 2018)(Citation: FireEye MuddyWater Mar 2018)(Citation: DHS CISA AA22-055A MuddyWater February 2022)
Earth Lusca	Earth Lusca has manipulated legitimate websites to inject malicious JavaScript code as part of their watering hole operations.(Citation: TrendMicro EarthLusca 2022)
GRIFFON	GRIFFON is written in and executed as JavaScript.(Citation: SecureList Griffon May 2019)
Silence	Silence has used JS scripts.(Citation: Cyber Forensicator Silence Jan 2019)
LazyScripter	LazyScripter has used JavaScript in its attacks.(Citation: MalwareBytes LazyScripter Feb 2021)
EnvyScout	EnvyScout can write files to disk with JavaScript using a modified version of the open-source tool FileSaver.(Citation: MSTIC Nobelium Toolset May 2021)
Valak	Valak can execute JavaScript containing configuration data for establishing persistence.(Citation: Cybereason Valak May 2020)
TA505	TA505 has used JavaScript for code execution.(Citation: Proofpoint TA505 Sep 2017)(Citation: Proofpoint TA505 June 2018)
InvisiMole	InvisiMole can use a JavaScript file as part of its execution chain.(Citation: ESET InvisiMole June 2020)
Astaroth	Astaroth uses JavaScript to perform its core functionalities. (Citation: Cofense Astaroth Sept 2018)(Citation: Securelist Brazilian Banking Malware July 2020)
FIN7	FIN7 used JavaScript scripts to help perform tasks on the victim's machine.(Citation: FireEye FIN7 Aug 2018)(Citation: Flashpoint FIN 7 March 2019)(Citation: FireEye FIN7 Aug 2018)
JSS Loader	JSS Loader can download and execute JavaScript files.(Citation: CrowdStrike Carbon Spider August 2021)
Donut	Donut can generate shellcode outputs that execute via JavaScript or JScript.(Citation: Donut Github)
Xbash	Xbash can execute malicious JavaScript payloads on the victim’s machine.(Citation: Unit42 Xbash Sept 2018)
Cobalt Group	Cobalt Group has executed JavaScript scriptlets on the victim's machine.(Citation: Talos Cobalt Group July 2018)(Citation: PTSecurity Cobalt Group Aug 2017)(Citation: Group IB Cobalt Aug 2017)(Citation: Morphisec Cobalt Gang Oct 2018)(Citation: Unit 42 Cobalt Gang Oct 2018)(Citation: TrendMicro Cobalt Group Nov 2017)
Higaisa	Higaisa used JavaScript to execute additional files.(Citation: Malwarebytes Higaisa 2020)(Citation: Zscaler Higaisa 2020)(Citation: PTSecurity Higaisa 2020)
Kimsuky	Kimsuky has used JScript for logging and downloading additional tools.(Citation: VirusBulletin Kimsuky October 2019)(Citation: CISA AA20-301A Kimsuky)
Ember Bear	Ember Bear has used JavaScript to execute malicious code on a victim's machine.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
jRAT	jRAT has been distributed as HTA files with JScript.(Citation: Kaspersky Adwind Feb 2016)
SpicyOmelette	SpicyOmelette has the ability to execute arbitrary JavaScript code on a compromised host.(Citation: Secureworks GOLD KINGSWOOD September 2018)
Indrik Spider	Indrik Spider has used malicious JavaScript files for several components of their attack.(Citation: Symantec WastedLocker June 2020)
POWERSTATS	POWERSTATS can use JavaScript code for execution.(Citation: ClearSky MuddyWater Nov 2018)
Molerats	Molerats used various implants, including those built with JS, on target machines.(Citation: Kaspersky MoleRATs April 2019)
Chaes	Chaes has used JavaScript and Node.Js information stealer script that exfiltrates data using the node process.(Citation: Cybereason Chaes Nov 2020)
Leafminer	Leafminer infected victims using JavaScript code.(Citation: Symantec Leafminer July 2018)
	During Operation Dust Storm, the threat actors used JavaScript code.(Citation: Cylance Dust Storm)
Bundlore	Bundlore can execute JavaScript by injecting it into the victim's browser.(Citation: MacKeeper Bundlore Apr 2019)
Evilnum	Evilnum has used malicious JavaScript files on the victim's machine.(Citation: ESET EvilNum July 2020)
KONNI	KONNI has executed malicious JavaScript code.(Citation: Malwarebytes Konni Aug 2021)
	During C0015, the threat actors used a malicious HTA file that contained a mix of encoded HTML and JavaScript/VBScript code.(Citation: DFIR Conti Bazar Nov 2021)
DarkWatchman	DarkWatchman uses JavaScript to perform its core functionalities.(Citation: Prevailion DarkWatchman 2021)

Mitigation	Description
Mitigations
Behavior Prevention on Endpoint	Use capabilities to prevent suspicious behavior patterns from occurring on endpoint systems. This could include suspicious process, file, API call, etc. behavior.
Execution Prevention	Block execution of code on a system through application control, and/or script blocking.
Disable or Remove Feature or Program	Remove or deny access to unnecessary and potentially vulnerable software to prevent abuse by adversaries.
Restrict Web-Based Content	Restrict use of certain websites, block downloads/attachments, block Javascript, restrict browser extensions, etc.

Detection

Monitor for events associated with scripting execution, such as process activity, usage of the Windows Script Host (typically cscript.exe or wscript.exe), file activity involving scripts, or loading of modules associated with scripting languages (ex: JScript.dll). Scripting execution is likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for execution and subsequent behavior. Actions may be related to network and system information Discovery, Collection, or other programmable post-compromise behaviors and could be used as indicators of detection leading back to the source. Monitor for execution of JXA through osascript and usage of OSAScript API that may be related to other suspicious behavior occurring on the system. Understanding standard usage patterns is important to avoid a high number of false positives. If scripting is restricted for normal users, then any attempts to enable related components running on a system would be considered suspicious. If scripting is not commonly used on a system, but enabled, execution running out of cycle from patching or other administrator functions is suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.

References

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.