Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Command and Scripting Interpreter: Visual Basic

Other sub-techniques of Command and Scripting Interpreter (8)

ID	Название
.001	PowerShell
.002	AppleScript
.003	Командная оболочка Windows
.004	Командная оболочка Unix
.005	Visual Basic
.006	Python
.007	JavaScript/JScript
.008	Интерпретаторы командной строки сетевых устройств

Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows technologies such as Component Object Model and the Native API through the Windows API. Although tagged as legacy with no planned future evolutions, VB is integrated and supported in the .NET Framework and cross-platform .NET Core.(Citation: VB .NET Mar 2020)(Citation: VB Microsoft) Derivative languages based on VB have also been created, such as Visual Basic for Applications (VBA) and VBScript. VBA is an event-driven programming language built into Microsoft Office, as well as several third-party applications.(Citation: Microsoft VBA)(Citation: Wikipedia VBA) VBA enables documents to contain macros used to automate the execution of tasks and other functionality on the host. VBScript is a default scripting language on Windows hosts and can also be used in place of JavaScript on HTML Application (HTA) webpages served to Internet Explorer (though most modern browsers do not come with VBScript support).(Citation: Microsoft VBScript) Adversaries may use VB payloads to execute malicious commands. Common malicious usage includes automating execution of behaviors with VBScript or embedding VBA content into Spearphishing Attachment payloads (which may also involve Mark-of-the-Web Bypass to enable execution).(Citation: Default VBS macros Blocking )

ID: T1059.005

Относится к технике: T1059

Тактика(-и): Execution

Платформы: Linux, macOS, Windows

Требуемые разрешения: Administrator, SYSTEM, User

Источники данных: Command: Command Execution, Module: Module Load, Process: Process Creation, Script: Script Execution

Версия: 1.3

Дата создания: 09 Mar 2020

Последнее изменение: 07 Mar 2022

Название	Описание
Примеры процедур
Lokibot	Lokibot has used VBS scripts and XLS macros for execution.(Citation: Talos Lokibot Jan 2021)
Patchwork	Patchwork used Visual Basic Scripts (VBS) on victim machines.(Citation: TrendMicro Patchwork Dec 2017)(Citation: Volexity Patchwork June 2018)
Grandoreiro	Grandoreiro can use VBScript to execute malicious code.(Citation: Securelist Brazilian Banking Malware July 2020)(Citation: ESET Grandoreiro April 2020)
BackConfig	BackConfig has used VBS to install its downloader component and malicious documents with VBA macro code.(Citation: Unit 42 BackConfig May 2020)
Squirrelwaffle	Squirrelwaffle has used malicious VBA macros in Microsoft Word documents and Excel spreadsheets that execute an `AutoOpen` subroutine.(Citation: ZScaler Squirrelwaffle Sep 2021)(Citation: Netskope Squirrelwaffle Oct 2021)
Koadic	Koadic performs most of its operations using Windows Script Host (VBScript) and runs arbitrary shellcode .(Citation: Github Koadic)
Higaisa	Higaisa has used VBScript code on the victim's machine.(Citation: PTSecurity Higaisa 2020)
Kerrdown	Kerrdown can use a VBS base64 decoder function published by Motobit.(Citation: Unit 42 KerrDown February 2019)
Goopy	Goopy has the ability to use a Microsoft Outlook backdoor macro to communicate with its C2.(Citation: Cybereason Cobalt Kitty 2017)
FIN4	FIN4 has used VBA macros to display a dialog box and collect victim credentials.(Citation: FireEye Hacking FIN4 Dec 2014)(Citation: FireEye Hacking FIN4 Video Dec 2014)
WIRTE	WIRTE has used VBScript in its operations.(Citation: Lab52 WIRTE Apr 2019)
Windshift	Windshift has used Visual Basic 6 (VB6) payloads.(Citation: BlackBerry Bahamut)
Turla	Turla has used VBS scripts throughout its operations.(Citation: Symantec Waterbug Jun 2019)
jRAT	jRAT has been distributed as HTA files with VBScript.(Citation: Kaspersky Adwind Feb 2016)
Xbash	Xbash can execute malicious VBScript payloads on the victim’s machine.(Citation: Unit42 Xbash Sept 2018)
Earth Lusca	Earth Lusca used VBA scripts.(Citation: TrendMicro EarthLusca 2022)
Rancor	Rancor has used VBS scripts as well as embedded macros for execution.(Citation: Rancor Unit42 June 2018)
APT29	APT29 has written malware variants in Visual Basic.(Citation: Cybersecurity Advisory SVR TTP May 2021)
	During FunnyDream, the threat actors used a Visual Basic script to run remote commands.(Citation: Bitdefender FunnyDream Campaign November 2020)
Mustang Panda	Mustang Panda has embedded VBScript components in LNK files to download additional files and automate collection.(Citation: Crowdstrike MUSTANG PANDA June 2018)(Citation: Anomali MUSTANG PANDA October 2019)(Citation: Secureworks BRONZE PRESIDENT December 2019)
Operation Wocao	Operation Wocao has used a VBScript to conduct reconnaissance on targeted systems.(Citation: FoxIT Wocao December 2019)
Transparent Tribe	Transparent Tribe has crafted VBS-based malicious documents.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Kaspersky Transparent Tribe August 2020)
VBShower	VBShower has the ability to execute VBScript files.(Citation: Kaspersky Cloud Atlas August 2019)
Exaramel for Windows	Exaramel for Windows has a command to execute VBS scripts on the victim’s machine.(Citation: ESET TeleBots Oct 2018)
Astaroth	Astaroth has used malicious VBS e-mail attachments for execution.(Citation: Securelist Brazilian Banking Malware July 2020)
Silence	Silence has used VBS scripts.(Citation: Cyber Forensicator Silence Jan 2019)
NanHaiShu	NanHaiShu executes additional VBScript code on the victim's machine.(Citation: fsecure NanHaiShu July 2016)
Gamaredon Group	Gamaredon Group has embedded malicious macros in document templates, which executed VBScript. Gamaredon Group has also delivered Microsoft Outlook VBA projects with embedded macros.(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET Gamaredon June 2020)(Citation: CERT-EE Gamaredon January 2021)(Citation: Microsoft Actinium February 2022)(Citation: Secureworks IRON TILDEN Profile)
LookBack	LookBack has used VBA macros in Microsoft Word attachments to drop additional files to the host.(Citation: Proofpoint LookBack Malware Aug 2019)
FIN7	FIN7 used VBS scripts to help perform tasks on the victim's machine.(Citation: FireEye FIN7 Aug 2018)(Citation: Flashpoint FIN 7 March 2019)(Citation: CrowdStrike Carbon Spider August 2021)
Chaes	Chaes has used VBscript to execute malicious code.(Citation: Cybereason Chaes Nov 2020)
Donut	Donut can generate shellcode outputs that execute via VBScript.(Citation: Donut Github)
Smoke Loader	Smoke Loader adds a Visual Basic script in the Startup folder to deploy the payload.(Citation: Malwarebytes SmokeLoader 2016)
APT38	APT38 has used VBScript to execute commands and other operational tasks.(Citation: CISA AA20-239A BeagleBoyz August 2020)
NETWIRE	NETWIRE has been executed through use of VBScripts.(Citation: FireEye NETWIRE March 2019)(Citation: Proofpoint NETWIRE December 2020)
Machete	Machete has embedded malicious macros within spearphishing attachments to download additional files.(Citation: 360 Machete Sep 2020)
Bisonal	Bisonal's dropper creates VBS scripts on the victim’s machine.(Citation: Unit 42 Bisonal July 2018)(Citation: Talos Bisonal Mar 2020)
REvil	REvil has used obfuscated VBA macros for execution.(Citation: G Data Sodinokibi June 2019)(Citation: Picus Sodinokibi January 2020)
MuddyWater	MuddyWater has used VBScript files to execute its POWERSTATS payload, as well as macros.(Citation: FireEye MuddyWater Mar 2018)(Citation: MuddyWater TrendMicro June 2018)(Citation: Securelist MuddyWater Oct 2018)(Citation: Symantec MuddyWater Dec 2018)(Citation: ClearSky MuddyWater Nov 2018)(Citation: ClearSky MuddyWater June 2019)(Citation: Reaqta MuddyWater November 2017)(Citation: Trend Micro Muddy Water March 2021)(Citation: Talos MuddyWater Jan 2022)
Flagpro	Flagpro can execute malicious VBA macros embedded in .xlsm files.(Citation: NTT Security Flagpro new December 2021)
BRONZE BUTLER	BRONZE BUTLER has used VBS and VBE scripts for execution.(Citation: Secureworks BRONZE BUTLER Oct 2017)(Citation: Trend Micro Tick November 2019)
Honeybee	Honeybee embeds a Visual Basic script within a malicious Word document as part of initial access; the script is executed when the Word document is opened.(Citation: McAfee Honeybee)
Confucius	Confucius has used VBScript to execute malicious code.(Citation: TrendMicro Confucius APT Feb 2018)
Lazarus Group	Lazarus Group has used VBScript to gather information about a victim machine. (Citation: F-Secure Lazarus Cryptocurrency Aug 2020)
	During Frankenstein, the threat actors used Word documents that prompted the victim to enable macros and run a Visual Basic script.(Citation: Talos Frankenstein June 2019)
Cobalt Strike	Cobalt Strike can use VBA to perform execution.(Citation: Cobalt Strike TTPs Dec 2017)(Citation: CobaltStrike Daddy May 2017)(Citation: Talos Cobalt Strike September 2020)
TA505	TA505 has used VBS for code execution.(Citation: Proofpoint TA505 Sep 2017)(Citation: Proofpoint TA505 June 2018)(Citation: Trend Micro TA505 June 2019)(Citation: IBM TA505 April 2020)
Bumblebee	Bumblebee can create a Visual Basic script to enable persistence.(Citation: Proofpoint Bumblebee April 2022)(Citation: Symantec Bumblebee June 2022)
OSX_OCEANLOTUS.D	OSX_OCEANLOTUS.D uses Word macros for execution.(Citation: TrendMicro MacOS April 2018)
Helminth	One version of Helminth consists of VBScript scripts.(Citation: Palo Alto OilRig May 2016)
Sharpshooter	Sharpshooter's first-stage downloader was a VBA macro.(Citation: McAfee Sharpshooter December 2018)
Magic Hound	Magic Hound malware has used VBS scripts for execution.(Citation: Unit 42 Magic Hound Feb 2017)
ROKRAT	ROKRAT has used Visual Basic for execution.(Citation: Malwarebytes RokRAT VBA January 2021)
Ferocious	Ferocious has the ability to use Visual Basic scripts for execution.(Citation: Kaspersky WIRTE November 2021)
QUADAGENT	QUADAGENT uses VBScripts.(Citation: Unit 42 QUADAGENT July 2018)
LazyScripter	LazyScripter has used VBScript to execute malicious code.(Citation: MalwareBytes LazyScripter Feb 2021)
JSS Loader	JSS Loader can download and execute VBScript files.(Citation: CrowdStrike Carbon Spider August 2021)
Frankenstein	Frankenstein has used Word documents that prompts the victim to enable macros and run a Visual Basic script.(Citation: Talos Frankenstein June 2019)
Lazarus Group	Lazarus Group has used VBA and embedded macros in Word documents to execute malicious code.(Citation: McAfee Lazarus Jul 2020)(Citation: ClearSky Lazarus Aug 2020)(Citation: Lazarus APT January 2022)(Citation: Qualys LolZarus)
Cobalt Group	Cobalt Group has sent Word OLE compound documents with malicious obfuscated VBA macros that will run upon user execution.(Citation: Talos Cobalt Group July 2018)(Citation: PTSecurity Cobalt Group Aug 2017)(Citation: Group IB Cobalt Aug 2017)(Citation: Morphisec Cobalt Gang Oct 2018)(Citation: Unit 42 Cobalt Gang Oct 2018)(Citation: TrendMicro Cobalt Group Nov 2017)
	During C0015, the threat actors used a malicious HTA file that contained a mix of HTML and JavaScript/VBScript code.(Citation: DFIR Conti Bazar Nov 2021)
Saint Bot	Saint Bot has used `.vbs` scripts for execution.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
OilRig	OilRig has used VBSscipt macros for execution on compromised hosts.(Citation: Check Point APT34 April 2021)
SideCopy	SideCopy has sent Microsoft Office Publisher documents to victims that have embedded malicious macros that execute an hta file via calling `mshta.exe`.(Citation: MalwareBytes SideCopy Dec 2021)
	During Operation Wocao, threat actors used VBScript to conduct reconnaissance on targeted systems.(Citation: FoxIT Wocao December 2019)
Comnie	Comnie executes VBS scripts.(Citation: Palo Alto Comnie)
Emotet	Emotet has sent Microsoft Word documents with embedded macros that will invoke scripts to download additional payloads. (Citation: Symantec Emotet Jul 2018)(Citation: Talos Emotet Jan 2019)(Citation: Trend Micro Emotet Jan 2019)(Citation: Picus Emotet Dec 2018)(Citation: Carbon Black Emotet Apr 2019)
Leviathan	Leviathan has used VBScript.(Citation: Proofpoint Leviathan Oct 2017)
JCry	JCry has used VBS scripts. (Citation: Carbon Black JCry May 2019)
STARWHALE	STARWHALE can use the VBScript function `GetRef` as part of its persistence mechanism.(Citation: Mandiant UNC3313 Feb 2022)
TA459	TA459 has a VBScript for execution.(Citation: Proofpoint TA459 April 2017)
DanBot	DanBot can use a VBA macro embedded in an Excel file to drop the payload.(Citation: SecureWorks August 2019)
Pteranodon	Pteranodon can use a malicious VBS file for execution.(Citation: Symantec Shuckworm January 2022)
IcedID	IcedID has used obfuscated VBA string expressions.(Citation: Juniper IcedID June 2020)
KeyBoy	KeyBoy uses VBS scripts for installing files and performing execution.(Citation: CitizenLab KeyBoy Nov 2016)
Melcoz	Melcoz can use VBS scripts to execute malicious DLLs.(Citation: Securelist Brazilian Banking Malware July 2020)
NanoCore	NanoCore uses VBS files.(Citation: Cofense NanoCore Mar 2018)
Sibot	Sibot executes commands using VBScript.(Citation: MSTIC NOBELIUM Mar 2021)
OopsIE	OopsIE creates and uses a VBScript as part of its persistent execution.(Citation: Unit 42 OopsIE! Feb 2018)(Citation: Unit 42 OilRig Sept 2018)
	During Operation Sharpshooter, the threat actors used a VBA macro to execute a simple downloader that installed Rising Sun.(Citation: McAfee Sharpshooter December 2018)
WhisperGate	WhisperGate can use a Visual Basic script to exclude the `C:\` drive from Windows Defender.(Citation: Unit 42 WhisperGate January 2022)(Citation: Cisco Ukraine Wipers January 2022)
Sidewinder	Sidewinder has used VBScript to drop and execute malware loaders.(Citation: ATT Sidewinder January 2021)
APT32	APT32 has used macros, COM scriptlets, and VBS scripts.(Citation: Cybereason Oceanlotus May 2017)(Citation: Cybereason Cobalt Kitty 2017)
PoetRAT	PoetRAT has used Word documents with VBScripts to execute malicious activities.(Citation: Talos PoetRAT April 2020)(Citation: Talos PoetRAT October 2020)
	For C0011, Transparent Tribe used malicious VBA macros within a lure document as part of the Crimson malware installation process onto a compromised host.(Citation: Cisco Talos Transparent Tribe Education Campaign July 2022)
Cobalt Strike	Cobalt Strike can use VBA to perform execution.(Citation: Cobalt Strike TTPs Dec 2017)(Citation: CobaltStrike Daddy May 2017)
SUNBURST	SUNBURST used VBScripts to initiate the execution of payloads.(Citation: Microsoft Deep Dive Solorigate January 2021)
Molerats	Molerats used various implants, including those built with VBScript, on target machines.(Citation: Kaspersky MoleRATs April 2019)(Citation: Unit42 Molerat Mar 2020)
Ursnif	Ursnif droppers have used VBA macros to download and execute the malware's full executable payload.(Citation: Bromium Ursnif Mar 2017)
	During Operation Dust Storm, the threat actors used Visual Basic scripts.(Citation: Cylance Dust Storm)
	During Operation CuckooBees, the threat actors executed an encoded VBScript file using `wscript` and wrote the decoded output to a text file.(Citation: Cybereason OperationCuckooBees May 2022)
Bandook	Bandook has used malicious VBA code against the target system.(Citation: CheckPoint Bandook Nov 2020)
Inception	Inception has used VBScript to execute malicious commands and payloads.(Citation: Unit 42 Inception November 2018)(Citation: Kaspersky Cloud Atlas December 2014)
POWERSTATS	POWERSTATS can use VBScript (VBE) code for execution.(Citation: ClearSky MuddyWater Nov 2018)(Citation: TrendMicro POWERSTATS V3 June 2019)
TYPEFRAME	TYPEFRAME has used a malicious Word document for delivery with VBA macros for execution.(Citation: US-CERT TYPEFRAME June 2018)
Remexi	Remexi uses AutoIt and VBS scripts throughout its execution process.(Citation: Securelist Remexi Jan 2019)
	For Operation Honeybee, the threat actors used a Visual Basic script embedded within a Word document to download an implant.(Citation: McAfee Honeybee)
APT-C-36	APT-C-36 has embedded a VBScript within a malicious Word document which is executed upon the document opening.(Citation: QiAnXin APT-C-36 Feb2019)
QakBot	QakBot can use VBS to download and execute malicious files.(Citation: Trend Micro Qakbot May 2020) (Citation: Kroll Qakbot June 2020)(Citation: Crowdstrike Qakbot October 2020)(Citation: Trend Micro Qakbot December 2020)(Citation: Cyberint Qakbot May 2021)(Citation: Group IB Ransomware September 2020)
HEXANE	HEXANE has used a VisualBasic script named `MicrosoftUpdator.vbs` for execution of a PowerShell keylogger.(Citation: Kaspersky Lyceum October 2021)
Ramsay	Ramsay has included embedded Visual Basic scripts in malicious documents.(Citation: Eset Ramsay May 2020)(Citation: Antiy CERT Ramsay April 2020)
KOCTOPUS	KOCTOPUS has used VBScript to call wscript to execute a PowerShell command.(Citation: MalwareBytes LazyScripter Feb 2021)
APT33	APT33 has used VBScript to initiate the delivery of payloads.(Citation: Microsoft Holmium June 2020)
APT37	APT37 executes shellcode and a VBA script to decode Base64 strings.(Citation: Talos Group123)
Sandworm Team	Sandworm Team has created VBScripts to run an SSH server.(Citation: ESET BlackEnergy Jan 2016)(Citation: ESET Telebots Dec 2016)(Citation: ESET Telebots June 2017)(Citation: Dragos Crashoverride 2018)
Kimsuky	Kimsuky has used Visual Basic to download malicious payloads.(Citation: ThreatConnect Kimsuky September 2020)(Citation: VirusBulletin Kimsuky October 2019)(Citation: Crowdstrike GTR2020 Mar 2020)(Citation: Talos Kimsuky Nov 2021) Kimsuky has also used malicious VBA macros within maldocs disguised as forms that trigger when a victim types any content into the lure.(Citation: Talos Kimsuky Nov 2021)
Metamorfo	Metamorfo has used VBS code on victims’ systems.(Citation: FireEye Metamorfo Apr 2018)
StoneDrill	StoneDrill has several VBS scripts used throughout the malware's lifecycle.(Citation: Kaspersky StoneDrill 2017)
PowerShower	PowerShower has the ability to save and execute VBScript.(Citation: Unit 42 Inception November 2018)
Gorgon Group	Gorgon Group has used macros in Spearphishing Attachments as well as executed VBScripts on victim machines.(Citation: Unit 42 Gorgon Group Aug 2018)
Javali	Javali has used embedded VBScript to download malicious payloads from C2.(Citation: Securelist Brazilian Banking Malware July 2020)
APT39	APT39 has utilized malicious VBS scripts in malware.(Citation: FBI FLASH APT39 September 2020)

Контрмера	Описание
Контрмеры
Disable or Remove Feature or Program	Remove or deny access to unnecessary and potentially vulnerable software to prevent abuse by adversaries.
Antivirus/Antimalware	Use signatures or heuristics to detect malicious software.
Execution Prevention	Block execution of code on a system through application control, and/or script blocking.
Behavior Prevention on Endpoint	Use capabilities to prevent suspicious behavior patterns from occurring on endpoint systems. This could include suspicious process, file, API call, etc. behavior.
Restrict Web-Based Content	Restrict use of certain websites, block downloads/attachments, block Javascript, restrict browser extensions, etc.

Обнаружение

Monitor for events associated with VB execution, such as Office applications spawning processes, usage of the Windows Script Host (typically cscript.exe or wscript.exe), file activity involving VB payloads or scripts, or loading of modules associated with VB languages (ex: vbscript.dll). VB execution is likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for execution and subsequent behavior. Actions may be related to network and system information Discovery, Collection, or other programable post-compromise behaviors and could be used as indicators of detection leading back to the source. Understanding standard usage patterns is important to avoid a high number of false positives. If VB execution is restricted for normal users, then any attempts to enable related components running on a system would be considered suspicious. If VB execution is not commonly used on a system, but enabled, execution running out of cycle from patching or other administrator functions is suspicious. Payloads and scripts should be captured from the file system when possible to determine their actions and intent.

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.