{
  "technique_id": "T1059",
  "mappings": [
    {
      "attack_technique": "T1059 Command and Scripting Interpreter",
      "d3fend_technique": "File Analysis",
      "soc_action": "Analyze the script/interpreter's file and arguments for encoded or obfuscated content and known offensive-tooling patterns.\n",
      "tooling": [
        "Defender for Endpoint",
        "Sentinel"
      ]
    },
    {
      "attack_technique": "T1059 Command and Scripting Interpreter",
      "d3fend_technique": "Dynamic Analysis",
      "soc_action": "Detonate or sandbox-execute the script to observe its real runtime behavior (network calls, child processes, file writes) beyond what static inspection of the command line shows.\n",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "attack_technique": "T1059 Command and Scripting Interpreter",
      "d3fend_technique": "Executable Allowlisting",
      "soc_action": "Apply Constrained Language Mode / AppLocker / WDAC allowlisting to restrict which interpreters and scripts are permitted to run.\n",
      "tooling": [
        "AppLocker",
        "WDAC"
      ]
    },
    {
      "attack_technique": "T1059 Command and Scripting Interpreter",
      "d3fend_technique": "Executable Denylisting",
      "soc_action": "Block known-malicious interpreter/script hashes or paths from executing.",
      "tooling": [
        "AppLocker",
        "Defender for Endpoint"
      ]
    }
  ]
}