T1059 Command and Scripting Interpreter
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of [Unix…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Potential QBot Activitycriticalstable · windows
- Bad Opsec Powershell Code Artifactscriticaltest · windows
- Elise Backdoor Activitycriticaltest · windows
- Greenbug Espionage Group Indicatorscriticaltest · windows
- HackTool - Sliver C2 Implant Activity Patterncriticaltest · windows
- Lazarus Group Activitycriticaltest · windows
- Linux Reverse Shell Indicatorcriticaltest · linux
- REvil Kaseya Incident Malware Patternscriticaltest · windows
- Rorschach Ransomware Execution Activitycriticaltest · windows
- Silence.EDA Detectioncriticaltest · windows
- Turla Group Commands May 2020criticaltest · windows
- Turla Group Lateral Movementcriticaltest · windows
- UNC2452 PowerShell Patterncriticaltest · windows
- ZxShell Malwarecriticaltest · windows
- HackTool - CrackMapExec Execution Patternshighstable · windows
- Potential Emotet Activityhighstable · windows
- Potential Powershell ReverseShell Connectionhighstable · windows
- Remote LSASS Process Access Through Windows Remote Managementhighstable · windows
- TropicTrooper Campaign November 2018highstable · windows
- Windows Defender AMSI Trigger Detectedhighstable · windows
- Windows Defender Threat Detectedhighstable · windows
- AWS EC2 Startup Shell Script Changehightest · aws
- AWS IAM S3Browser LoginProfile Creationhightest · aws
- AWS IAM S3Browser Templated S3 Bucket Policy Creationhightest · aws
- AWS IAM S3Browser User or AccessKey Creationhightest · aws
Showing 25 of 189.
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.