1. Home
  2. Techniques
  3. Enterprise
  4. Command and Scripting Interpreter
  5. JavaScript

Command and Scripting Interpreter: JavaScript

ID Name
T1059.001 PowerShell
T1059.002 AppleScript
T1059.003 Windows Command Shell
T1059.004 Unix Shell
T1059.005 Visual Basic
T1059.006 Python
T1059.007 JavaScript
T1059.008 Network Device CLI

Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.[1]

JScript is the Microsoft implementation of the same scripting standard. JScript is interpreted via the Windows Script engine and thus integrated with many components of Windows such as the Component Object Model and Internet Explorer HTML Application (HTA) pages.[2][3][4]

JavaScript for Automation (JXA) is a macOS scripting language based on JavaScript, included as part of Apple’s Open Scripting Architecture (OSA), that was introduced in OSX 10.10. Apple’s OSA provides scripting capabilities to control applications, interface with the operating system, and bridge access into the rest of Apple’s internal APIs. As of OSX 10.10, OSA only supports two languages, JXA and AppleScript. Scripts can be executed via the command line utility osascript, they can be compiled into applications or script files via osacompile, and they can be compiled and executed in memory of other programs by leveraging the OSAKit Framework.[5][6][7][8][9]

Adversaries may abuse various implementations of JavaScript to execute various behaviors. Common uses include hosting malicious scripts on websites as part of a Drive-by Compromise or downloading and executing these script files as secondary payloads. Since these payloads are text-based, it is also very common for adversaries to obfuscate their content as part of Obfuscated Files or Information.

ID: T1059.007
Sub-technique of:  T1059
ⓘ
Tactic: Execution
ⓘ
Platforms: Linux, Windows, macOS
ⓘ
Permissions Required: Administrator, SYSTEM, User
Contributors: Cody Thomas, SpecterOps
Version: 2.1
Created: 23 June 2020
Last Modified: 16 August 2021
Provided by LAYER 8

Procedure Examples

ID Name Description
S0622 AppleSeed

AppleSeed has the ability to use JavaScript to execute PowerShell.[10]
G0050 APT32

APT32 has used JavaScript for drive-by downloads and C2 communications.[11][12]
S0373 Astaroth

Astaroth uses JavaScript to perform its core functionalities. [13][14]
S0640 Avaddon

Avaddon has been executed through a malicious JScript downloader.[15][16]
S0482 Bundlore

Bundlore can execute JavaScript by injecting it into the victim's browser.[17]
S0631 Chaes

Chaes has used JavaScript and Node.Js information stealer script that exfiltrates data using the node process.[18]
G0080 Cobalt Group

Cobalt Group has executed JavaScript scriptlets on the victim's machine.[19][20][21][22][23][24]
S0154 Cobalt Strike

The Cobalt Strike System Profiler can use JavaScript to perform reconnaissance actions.[25]
S0634 EnvyScout

EnvyScout can write files to disk with JavaScript using a modified version of the open-source tool FileSaver.[26]
G0120 Evilnum

Evilnum has used malicious JavaScript files on the victim's machine.[27]
G0037 FIN6

FIN6 has used malicious JavaScript to steal payment card data from e-commerce sites.[28]
G0046 FIN7

FIN7 used JavaScript scripts to help perform tasks on the victim's machine.[29][30][29]
S0417 GRIFFON

GRIFFON is written in and executed as JavaScript.[31]

G0126 Higaisa

Higaisa used JavaScript to execute additional files.[32][33][34]
G0119 Indrik Spider

Indrik Spider has used malicious JavaScript files for several components of their attack.[35]
S0260 InvisiMole

InvisiMole can use a JavaScript file as part of its execution chain.[36]
S0283 jRAT

jRAT has been distributed as HTA files with JScript.[37]

S0648 JSS Loader

JSS Loader can download and execute JavaScript files.[38]
G0094 Kimsuky

Kimsuky has used JScript for logging and downloading additional tools.[39][40]
G0077 Leafminer

Leafminer infected victims using JavaScript code.[41]
S0455 Metamorfo

Metamorfo includes payloads written in JavaScript.[42]

G0021 Molerats

Molerats used various implants, including those built with JS, on target machines.[43]

G0069 MuddyWater

MuddyWater has used JavaScript files to execute its POWERSTATS payload.[44][45]
S0228 NanHaiShu

NanHaiShu executes additional Jscript code on the victim's machine.[46]
S0223 POWERSTATS

POWERSTATS can use JavaScript code for execution.[44]
S0650 QakBot

The QakBot web inject module can inject Java Script into web banking pages visited by the victim.[47]
G0121 Sidewinder

Sidewinder has used JavaScript to drop and execute malware loaders.[48][49]
G0091 Silence

Silence has used JS scripts.[50]
S0646 SpicyOmelette

SpicyOmelette has the ability to execute arbitrary JavaScript code on a compromised host.[51]
G0092 TA505

TA505 has used JavaScript for code execution.[52][53]
G0010 Turla

Turla has used various JavaScript-based backdoors.[54]

S0476 Valak

Valak can execute JavaScript containing configuration data for establishing persistence.[55]
S0341 Xbash

Xbash can execute malicious JavaScript payloads on the victim’s machine.[56]

Mitigations

ID Mitigation Description
M1040 Behavior Prevention on Endpoint

On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent JavaScript scripts from executing potentially malicious downloaded content [57].
M1042 Disable or Remove Feature or Program

Turn off or restrict access to unneeded scripting components.
M1038 Execution Prevention

Denylist scripting where appropriate.
M1021 Restrict Web-Based Content

Script blocking extensions can help prevent the execution of JavaScript and HTA files that may commonly be used during the exploitation process. For malicious code served up through ads, adblockers can help prevent that code from executing in the first place.

Detection

ID Data Source Data Component
DS0017 Command Command Execution
DS0011 Module Module Load
DS0009 Process Process Creation
DS0012 Script Script Execution

Monitor for events associated with scripting execution, such as process activity, usage of the Windows Script Host (typically cscript.exe or wscript.exe), file activity involving scripts, or loading of modules associated with scripting languages (ex: JScript.dll). Scripting execution is likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for execution and subsequent behavior. Actions may be related to network and system information Discovery, Collection, or other programmable post-compromise behaviors and could be used as indicators of detection leading back to the source.

Monitor for execution of JXA through osascript and usage of OSAScript API that may be related to other suspicious behavior occurring on the system.

Understanding standard usage patterns is important to avoid a high number of false positives. If scripting is restricted for normal users, then any attempts to enable related components running on a system would be considered suspicious. If scripting is not commonly used on a system, but enabled, execution running out of cycle from patching or other administrator functions is suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.

References

  1. OpenJS Foundation. (n.d.). Node.js. Retrieved June 23, 2020.
  2. Microsoft. (2018, May 31). Translating to JScript. Retrieved June 23, 2020.
  3. Microsoft. (2007, August 15). The World of JScript, JavaScript, ECMAScript …. Retrieved June 23, 2020.
  4. Microsoft. (2017, January 18). Windows Script Interfaces. Retrieved June 23, 2020.
  5. Apple. (2016, June 13). About Mac Scripting. Retrieved April 14, 2021.
  6. Pitt, L. (2020, August 6). Persistent JXA. Retrieved April 14, 2021.
  7. Phil Stokes. (2019, December 5). macOS Red Team: Calling Apple APIs Without Building Binaries. Retrieved July 17, 2020.
  8. Tony Lambert. (2021, February 18). Clipping Silver Sparrow’s wings: Outing macOS malware before it takes flight. Retrieved April 20, 2021.
  9. Dominic Chell. (2021, January 1). macOS Post-Exploitation Shenanigans with VSCode Extensions. Retrieved April 20, 2021.
  10. Jazi, H. (2021, June 1). Kimsuky APT continues to target South Korean government using AppleSeed backdoor. Retrieved June 10, 2021.
  11. Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.
  12. Adair, S. and Lancaster, T. (2020, November 6). OceanLotus: Extending Cyber Espionage Operations Through Fake Websites. Retrieved November 20, 2020.
  13. Doaty, J., Garrett, P.. (2018, September 10). We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan. Retrieved April 17, 2019.
  14. GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.
  15. Security Lab. (2020, June 5). Avaddon: From seeking affiliates to in-the-wild in 2 days. Retrieved August 19, 2021.
  16. Gahlot, A. (n.d.). Threat Hunting for Avaddon Ransomware. Retrieved August 19, 2021.
  17. Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.
  18. Salem, E. (2020, November 17). CHAES: Novel Malware Targeting Latin American E-Commerce. Retrieved June 30, 2021.
  19. Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.
  20. Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018.
  21. Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.
  22. Gorelik, M. (2018, October 08). Cobalt Group 2.0. Retrieved November 5, 2018.
  23. Unit 42. (2018, October 25). New Techniques to Uncover and Attribute Financial actors Commodity Builders and Infrastructure Revealed. Retrieved December 11, 2018.
  24. Giagone, R., Bermejo, L., and Yarochkin, F. (2017, November 20). Cobalt Strikes Again: Spam Runs Use Macros and CVE-2017-8759 Exploit Against Russian Banks. Retrieved March 7, 2019.
  25. Mavis, N. (2020, September 21). The Art and Science of Detecting Cobalt Strike. Retrieved April 6, 2021.
  26. MSTIC. (2021, May 28). Breaking down NOBELIUM’s latest early-stage toolset. Retrieved August 4, 2021.
  27. Porolli, M. (2020, July 9). More evil: A deep look at Evilnum and its toolset. Retrieved January 22, 2021.
  28. Chen, J. (2019, October 10). Magecart Card Skimmers Injected Into Online Shops. Retrieved September 9, 2020.
  29. Carr, N., et al. (2018, August 01). On the Hunt for FIN7: Pursuing an Enigmatic and Evasive Global Criminal Operation. Retrieved August 23, 2018.
  1. Platt, J. and Reeves, J.. (2019, March). FIN7 Revisited: Inside Astra Panel and SQLRat Malware. Retrieved June 18, 2019.
  2. Namestnikov, Y. and Aime, F. (2019, May 8). FIN7.5: the infamous cybercrime rig “FIN7” continues its activities. Retrieved October 11, 2019.
  3. Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.
  4. Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.
  5. PT ESC Threat Intelligence. (2020, June 4). COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group. Retrieved March 2, 2021.
  6. Symantec Threat Intelligence. (2020, June 25). WastedLocker: Symantec Identifies Wave of Attacks Against U.S. Organizations. Retrieved May 20, 2021.
  7. Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.
  8. Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.
  9. Loui, E. and Reynolds, J. (2021, August 30). CARBON SPIDER Embraces Big Game Hunting, Part 1. Retrieved September 20, 2021.
  10. Kim, J. et al. (2019, October). KIMSUKY GROUP: TRACKING THE KING OF THE SPEAR PHISHING. Retrieved November 2, 2020.
  11. CISA, FBI, CNMF. (2020, October 27). https://us-cert.cisa.gov/ncas/alerts/aa20-301a. Retrieved November 4, 2020.
  12. Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
  13. Erlich, C. (2020, April 3). The Avast Abuser: Metamorfo Banking Malware Hides By Abusing Avast Executable. Retrieved May 26, 2020.
  14. GReAT. (2019, April 10). Gaza Cybergang Group1, operation SneakyPastes. Retrieved May 13, 2020.
  15. ClearSky Cyber Security. (2018, November). MuddyWater Operations in Lebanon and Oman: Using an Israeli compromised domain for a two-stage campaign. Retrieved November 29, 2018.
  16. Singh, S. et al.. (2018, March 13). Iranian Threat Group Updates Tactics, Techniques and Procedures in Spear Phishing Campaign. Retrieved April 11, 2018.
  17. F-Secure Labs. (2016, July). NANHAISHU RATing the South China Sea. Retrieved July 6, 2018.
  18. Kuzmenko, A. et al. (2021, September 2). QakBot technical analysis. Retrieved September 27, 2021.
  19. Hegel, T. (2021, January 13). A Global Perspective of the SideWinder APT. Retrieved January 27, 2021.
  20. Rewterz. (2020, June 22). Analysis on Sidewinder APT Group – COVID-19. Retrieved January 29, 2021.
  21. Skulkin, O.. (2019, January 20). Silence: Dissecting Malicious CHM Files and Performing Forensic Analysis. Retrieved May 24, 2019.
  22. CTU. (2018, September 27). Cybercriminals Increasingly Trying to Ensnare the Big Financial Fish. Retrieved September 20, 2021.
  23. Proofpoint Staff. (2017, September 27). Threat Actor Profile: TA505, From Dridex to GlobeImposter. Retrieved May 28, 2019.
  24. Proofpoint Staff. (2018, June 8). TA505 shifts with the times. Retrieved May 28, 2019.
  25. ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.
  26. Salem, E. et al. (2020, May 28). VALAK: MORE THAN MEETS THE EYE . Retrieved June 19, 2020.
  27. Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.
  28. Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.