T1059.007 JavaScript
Subtécnica de T1059 Command and Scripting Interpreter
Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.(Citation: NodeJS) JScript is the Microsoft implementation of the same scripting standard. JScript is…
Quién la usa · con noticias en Jábega
Reglas Sigma para cazarla
- Adwind RAT / JRAThightest · windows
- Adwind RAT / JRAT File Artifacthightest · windows
- Csc.EXE Execution Form Potentially Suspicious Parenthightest · windows
- Cscript/Wscript Uncommon Script Extension Executionhightest · windows
- HTML Help HH.EXE Suspicious Child Processhightest · windows
- HackTool - CACTUSTORCH Remote Thread Creationhightest · windows
- HackTool - Koadic Executionhightest · windows
- JXA In-memory Execution Via OSAScripthightest · macos
- MSHTA Execution with Suspicious File Extensionshightest · windows
- Potential Remote SquiblyTwo Technique Executionhightest · windows
- Suspicious HH.EXE Executionhightest · windows
- WScript or CScript Dropper - Filehightest · windows
- Script Interpreter Spawning Credential Scanner - Windowshighexperimental · windows
- TanStack Supply-Chain Attack Execution Indicators - Linuxhighexperimental · linux
- TanStack Supply-Chain Attack Execution Indicators - Windowshighexperimental · windows
- AppLocker Prevented Application or Script from Runningmediumtest · windows
- Node Process Executionsmediumtest · windows
- Potential Dropper Script Execution Via WScript/CScript/MSHTAmediumtest · windows
- Potential In-Memory Download And Compile Of Payloadsmediumtest · macos
- Suspicious Installer Package Child Processmediumtest · macos
- XSL Script Execution Via WMIC.EXEmediumtest · windows
- AppLocker Application Would Have Been Blockedmediumexperimental · windows
- New Agent Skills Installation Attempt Via Node.EXEmediumexperimental · windows
- Potentially Suspicious Inline JavaScript Execution via NodeJS Binarymediumexperimental · windows
- TanStack Supply-Chain Attack File Creation Indicators - Linuxmediumexperimental · linux
Mostrando 25 de 26.
Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.