# T1059 - Command and Scripting Interpreter

## SOC Recommendation
Treat unusual interpreter activity — especially PowerShell with encoded or obfuscated arguments, spawned from an unexpected parent process, or reaching out to the network — as probable execution of attacker tooling rather than routine administration until the parent process, argument content, and operator are validated.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| File Analysis | Detect | Analyze the script/interpreter's file and arguments for encoded or obfuscated content and known offensive-tooling patterns. |
| Dynamic Analysis | Detect | Detonate or sandbox-execute the script to observe its real runtime behavior (network calls, child processes, file writes) beyond what static inspection of the command line shows. |
| Executable Allowlisting | Isolate | Apply Constrained Language Mode / AppLocker / WDAC allowlisting to restrict which interpreters and scripts are permitted to run. |
| Executable Denylisting | Isolate | Block known-malicious interpreter/script hashes or paths from executing. |

## Investigation Steps
1. where RegistryKey has_any ("CurrentVersion\\Run","Services","Scheduled")
2. where ActionType in ("RegistryKeyCreated","RegistryValueSet")
3. project Timestamp, RegistryKey, RegistryValueName, RegistryValueData

## Evidence to Collect
- Host and user
- Interpreter binary and full command line
- Parent process chain
- Decoded script content
- Network connections made during/after execution
- Files written or modified

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Kill the PowerShell process via MDE Live Response: kill <PI | Low | No | Yes |
| Block download URL and C2 IP in MDE custom indicators | Medium | No | Yes |
| Quarantine any dropped files (SHA256 block) | Medium | No | Yes |
| Isolate device if payload downloaded or executed | Medium | No | Yes |
| Enable PowerShell Constrained Language Mode via GPO | Low | No | Yes |
| Enable Script Block Logging via Group Policy (records all Po | Medium | No | Yes |
| Consider enabling AMSI (Antimalware Scan Interface) enforcem | Low | No | Yes |

## KQL
```kql
let KnownGoodParents = dynamic([
    "devenv.exe", "msbuild.exe", "AzurePowerShell.exe",
    "AzureAD.exe", "AzureConnectedMachineAgent.exe"
]);
DeviceProcessEvents
| where TimeGenerated >= ago(5m)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any (
    "-EncodedCommand", "-enc ",
    "IEX", "Invoke-Expression",
    "DownloadString", "DownloadFile", "DownloadData",
    "Net.WebClient", "System.Net.WebClient",
    "-ExecutionPolicy Bypass", "-ep bypass",
    "WindowStyle Hidden", "-w hidden",
    "FromBase64String", "[Convert]::",
    "Invoke-WebRequest", "Start-BitsTransfer", "Invoke-RestMethod",
    "New-Object System.Net.Sockets", "System.Net.Sockets"
)
| where not(InitiatingProcessFileName in~ (KnownGoodParents))
| project
    TimeGenerated, DeviceName, AccountName, AccountDomain,
    ProcessCommandLine, InitiatingProcessFileName,
    InitiatingProcessCommandLine, SHA256, FolderPath
| extend timestamp = TimeGenerated,
         HostCustomEntity = DeviceName,
         AccountCustomEntity = AccountName
| order by TimeGenerated desc
```
```kql
let SunburstMD5=dynamic(["b91ce2fa41029f6955bff20079468448","02af7cec58b9a5da1c542b5a32151ba1","2c4a910a1299cdae2a4e55988a2f102e","846e27a652a5e1bfbd0ddd38a16dc865","4f2eb62fa529c0283b28d05ddd311fae"]);
let SupernovaMD5="56ceb6d0011d87b6e4d7023d7ef85676";
imFileEvent
| where TargetFileMD5 in (SunburstMD5) or TargetFileMD5 in (SupernovaMD5)
| extend AccountName = tostring(split(User, @'\')[1]), AccountNTDomain = tostring(split(User, @'\')[0])
| extend AlgorithmType = "MD5"
```
```kql
let Threshold = 3;
AzureDiagnostics
| where Category == "ApplicationGatewayFirewallLog"
| where action_s == "Matched"
| project transactionId_g, hostname_s, requestUri_s, TimeGenerated, clientIp_s, Message, details_message_s, details_data_s
| join kind = inner(
AzureDiagnostics
| where Category == "ApplicationGatewayFirewallLog"
| where action_s == "Blocked"
| parse Message with MessageText 'Total Inbound Score: ' TotalInboundScore ' - SQLI=' SQLI_Score ',XSS=' XSS_Score ',RFI=' RFI_Score ',LFI=' LFI_Score ',RCE=' RCE_Score ',PHPI=' PHPI_Score ',HTTP=' HTTP_Score ',SESS=' SESS_Score '): ' Blocked_Reason '; individual paranoia level scores:' Paranoia_Score
| where Blocked_Reason contains "SQL Injection Attack" and toint(SQLI_Score) >=10 and toint(TotalInboundScore) >= 15) on transactionId_g
| extend Uri = strcat(hostname_s,requestUri_s)
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TransactionID = make_set(transactionId_g), Message = make_set(Message), Detail_Message = make_set(details_message_s), Detail_Data = make_set(details_data_s), Total_TransactionId = dcount(transactionId_g) by clientIp_s, Uri, action_s, SQLI_Score, TotalInboundScore
| where Total_TransactionId >= Threshold
```

## Escalation Criteria
- Encoded/obfuscated command line reaching out to an external host.
- Interpreter spawned from an unusual parent (Office app, browser, scheduled task).
- Activity on a server holding sensitive data or privileged access.
- Matches known offensive tooling signatures (C2 frameworks, credential dumping scripts).

## False Positive Considerations
- Intune / Endpoint Manager deployment scripts — Exclude by signed parent process (Microsoft.Management.Services.IntuneWindowsAgent.exe)
- Azure Arc management commands — Exclude by AzureConnectedMachineAgent.exe parent — already in KnownGoodParents
- IT team automation (Ansible WinRM, Chef) — Exclude by specific management server IP initiating the WinRM session

Generated by SOC Response Atlas by Basyrix.