{ "technique_id": "T1059", "name": "Command and Scripting Interpreter", "priority": "high", "status": "complete", "version": "0.1.0", "last_reviewed": "2026-07-23", "generated_by": "SOC Response Atlas by Basyrix", "tactics": [ "Execution" ], "platforms": [ "Windows", "Linux", "macOS" ], "summary": "Adversaries may abuse command and script interpreters (PowerShell, cmd, bash, Python, JavaScript/JScript, VBScript) to execute commands, scripts, or binaries as part of initial execution, lateral movement, or post-exploitation tooling.\n", "soc_recommendation": "Treat unusual interpreter activity — especially PowerShell with encoded or obfuscated arguments, spawned from an unexpected parent process, or reaching out to the network — as probable execution of attacker tooling rather than routine administration until the parent process, argument content, and operator are validated.\n", "d3fend_mappings": [ { "id": "D3-FA", "name": "File Analysis", "relationship": "detect", "practical_action": "Analyze the script/interpreter's file and arguments for encoded or obfuscated content and known offensive-tooling patterns.\n", "tooling": [ "Defender for Endpoint", "Sentinel" ] }, { "id": "D3-DA", "name": "Dynamic Analysis", "relationship": "detect", "practical_action": "Detonate or sandbox-execute the script to observe its real runtime behavior (network calls, child processes, file writes) beyond what static inspection of the command line shows.\n", "tooling": [ "Defender for Endpoint" ] }, { "id": "D3-EAL", "name": "Executable Allowlisting", "relationship": "isolate", "practical_action": "Apply Constrained Language Mode / AppLocker / WDAC allowlisting to restrict which interpreters and scripts are permitted to run.\n", "tooling": [ "AppLocker", "WDAC" ] }, { "id": "D3-EDL", "name": "Executable Denylisting", "relationship": "isolate", "practical_action": "Block known-malicious interpreter/script hashes or paths from executing.", "tooling": [ "AppLocker", "Defender for Endpoint" ] } ], "investigation_steps": { "microsoft": [ "where RegistryKey has_any (\"CurrentVersion\\\\Run\",\"Services\",\"Scheduled\")", "where ActionType in (\"RegistryKeyCreated\",\"RegistryValueSet\")", "project Timestamp, RegistryKey, RegistryValueName, RegistryValueData" ], "generic": [ "Identify the interpreter, its arguments, and its parent process.", "Decode/deobfuscate any encoded command-line arguments.", "Determine whether the script or command matches known offensive tooling patterns.", "Check for follow-on network connections, file writes, or child processes.", "Real detection reference: \"Suspicious PowerShell Encoded Command or Download Cradle\" -- Flags PowerShell launched with flags commonly abused to download and execute payloads: encoded commands, download cradles (IEX/DownloadString/WebClient), execution policy bypass, or hidden window mode." ] }, "evidence_to_collect": [ "Host and user", "Interpreter binary and full command line", "Parent process chain", "Decoded script content", "Network connections made during/after execution", "Files written or modified" ], "response_actions": [ { "name": "Kill the PowerShell process via MDE Live Response: kill " }, { "name": "Block download URL and C2 IP in MDE custom indicators", "category": "Containment", "risk": "Medium", "automation_safe": false, "approval_required": true, "tool": "Defender for Endpoint" }, { "name": "Quarantine any dropped files (SHA256 block)", "category": "Containment", "risk": "Medium", "automation_safe": false, "approval_required": true, "tool": "See investigation guide" }, { "name": "Isolate device if payload downloaded or executed", "category": "Containment", "risk": "Medium", "automation_safe": false, "approval_required": true, "tool": "See investigation guide" }, { "name": "Enable PowerShell Constrained Language Mode via GPO", "category": "Response", "risk": "Low", "automation_safe": false, "approval_required": true, "tool": "See investigation guide" }, { "name": "Enable Script Block Logging via Group Policy (records all Po", "category": "Response", "risk": "Medium", "automation_safe": false, "approval_required": true, "tool": "See investigation guide", "notes": "Enable Script Block Logging via Group Policy (records all PowerShell content)" }, { "name": "Consider enabling AMSI (Antimalware Scan Interface) enforcem", "category": "Response", "risk": "Low", "automation_safe": false, "approval_required": true, "tool": "See investigation guide", "notes": "Consider enabling AMSI (Antimalware Scan Interface) enforcement" } ], "queries": { "kql": [ { "name": "GEN-EX-001 — Suspicious PowerShell Encoded Command or Download Cradle", "description": "Flags PowerShell launched with flags commonly abused to download and execute payloads: encoded commands, download cradles (IEX/DownloadString/WebClient), execution policy bypass, or hidden window mode. (Source: Bell Integration baseline detection library, mapped via sub-technique T1059.001.)", "query": "let KnownGoodParents = dynamic([\n \"devenv.exe\", \"msbuild.exe\", \"AzurePowerShell.exe\",\n \"AzureAD.exe\", \"AzureConnectedMachineAgent.exe\"\n]);\nDeviceProcessEvents\n| where TimeGenerated >= ago(5m)\n| where FileName in~ (\"powershell.exe\", \"pwsh.exe\")\n| where ProcessCommandLine has_any (\n \"-EncodedCommand\", \"-enc \",\n \"IEX\", \"Invoke-Expression\",\n \"DownloadString\", \"DownloadFile\", \"DownloadData\",\n \"Net.WebClient\", \"System.Net.WebClient\",\n \"-ExecutionPolicy Bypass\", \"-ep bypass\",\n \"WindowStyle Hidden\", \"-w hidden\",\n \"FromBase64String\", \"[Convert]::\",\n \"Invoke-WebRequest\", \"Start-BitsTransfer\", \"Invoke-RestMethod\",\n \"New-Object System.Net.Sockets\", \"System.Net.Sockets\"\n)\n| where not(InitiatingProcessFileName in~ (KnownGoodParents))\n| project\n TimeGenerated, DeviceName, AccountName, AccountDomain,\n ProcessCommandLine, InitiatingProcessFileName,\n InitiatingProcessCommandLine, SHA256, FolderPath\n| extend timestamp = TimeGenerated,\n HostCustomEntity = DeviceName,\n AccountCustomEntity = AccountName\n| order by TimeGenerated desc" }, { "name": "bc5ffe2a-84d6-48fe-bc7b-1055100469bc — SUNBURST and SUPERNOVA backdoor hashes (Normalized File Events)", "description": "Identifies SolarWinds SUNBURST and SUPERNOVA backdoor file hash IOCs in File Events To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimFileEvent) References: - https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html - https://gist.github.com/olafhartong/71ffdd4cab4b6acd5cbcd1a0691ff82f (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)", "query": "let SunburstMD5=dynamic([\"b91ce2fa41029f6955bff20079468448\",\"02af7cec58b9a5da1c542b5a32151ba1\",\"2c4a910a1299cdae2a4e55988a2f102e\",\"846e27a652a5e1bfbd0ddd38a16dc865\",\"4f2eb62fa529c0283b28d05ddd311fae\"]);\nlet SupernovaMD5=\"56ceb6d0011d87b6e4d7023d7ef85676\";\nimFileEvent\n| where TargetFileMD5 in (SunburstMD5) or TargetFileMD5 in (SupernovaMD5)\n| extend AccountName = tostring(split(User, @'\\')[1]), AccountNTDomain = tostring(split(User, @'\\')[0])\n| extend AlgorithmType = \"MD5\"" }, { "name": "68c0b6bb-6bd9-4ef4-9011-08998c8ef90f — Application Gateway WAF - SQLi Detection", "description": "Identifies a match for SQL Injection attack in the Application gateway WAF logs. The Threshold value in the query can be changed as per your infrastructure's requirement. References: https://owasp.org/Top10/A03_2021-Injection/' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)", "query": "let Threshold = 3;\nAzureDiagnostics\n| where Category == \"ApplicationGatewayFirewallLog\"\n| where action_s == \"Matched\"\n| project transactionId_g, hostname_s, requestUri_s, TimeGenerated, clientIp_s, Message, details_message_s, details_data_s\n| join kind = inner(\nAzureDiagnostics\n| where Category == \"ApplicationGatewayFirewallLog\"\n| where action_s == \"Blocked\"\n| parse Message with MessageText 'Total Inbound Score: ' TotalInboundScore ' - SQLI=' SQLI_Score ',XSS=' XSS_Score ',RFI=' RFI_Score ',LFI=' LFI_Score ',RCE=' RCE_Score ',PHPI=' PHPI_Score ',HTTP=' HTTP_Score ',SESS=' SESS_Score '): ' Blocked_Reason '; individual paranoia level scores:' Paranoia_Score\n| where Blocked_Reason contains \"SQL Injection Attack\" and toint(SQLI_Score) >=10 and toint(TotalInboundScore) >= 15) on transactionId_g\n| extend Uri = strcat(hostname_s,requestUri_s)\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TransactionID = make_set(transactionId_g), Message = make_set(Message), Detail_Message = make_set(details_message_s), Detail_Data = make_set(details_data_s), Total_TransactionId = dcount(transactionId_g) by clientIp_s, Uri, action_s, SQLI_Score, TotalInboundScore\n| where Total_TransactionId >= Threshold" } ], "spl": [ { "name": "Encoded PowerShell execution", "description": "Search for encoded PowerShell command lines.", "query": "index=endpoint process_name=powershell.exe earliest=-24h\n| search process_command_line=\"*-enc*\" OR process_command_line=\"*EncodedCommand*\"\n" } ], "esql": [ { "name": "74d31cb7-4a2c-44fe-9d1d-f375b9f3cb61 — Long Base64 Encoded Command via Scripting Interpreter", "description": "(ESQL) Identifies oversized command lines used by Python, PowerShell, Node.js, or Deno that contain base64 decoding or encoded-command patterns. Adversaries may embed long inline encoded payloads in scripting interpreters to evade inspection and execute malicious content across Windows, macOS, and Linux systems. (Source: Elastic's official detection-rules repository (Elastic License v2).)", "query": "FROM logs-endpoint.events.process-* METADATA _id, _index, _version, _ignored\n| MV_EXPAND _ignored\n| WHERE _ignored == \"process.command_line\"\n| WHERE event.category == \"process\" and event.type == \"start\"\n| EVAL command_line = TO_LOWER(process.command_line.text), pname = TO_LOWER(process.name)\n| WHERE \n(\n (\n /* Python: inline exec with base64 decode or -c flag with encoded payload */\n pname like \"python*\" and\n (\n command_line like \"*b64decode*\" or\n (command_line like \"*-c*\" and command_line like \"*base64*\")\n )\n ) or\n (\n /* PowerShell: encoded command flag — require trailing space to avoid matching\n -Encoding, -EncryptionType, -EncryptionProvider, etc. */\n (pname like \"powershell*\" or pname like \"pwsh*\") and\n (\n command_line rlike \".* -(e|en|enc|enco|encod|encode|encoded|encodedcommand) .+\" or\n command_line like \"*-encodedcommand*\" or\n command_line like \"*frombase64string*\"\n )\n ) or\n (\n /* Node.js: buffer.from must be paired with base64 to avoid matching\n general Buffer usage; atob is always base64 */\n pname like \"node*\" and\n (\n (command_line like \"*buffer.from*\" and command_line like \"*base64*\") or\n command_line like \"*atob(*\"\n )\n ) or\n (\n /* Deno: eval( (not eval/evaluate/evaluation), atob, or buffer+base64 */\n pname like \"deno*\" and\n (\n command_line like \"*atob(*\" or\n (command_line like \"*buffer.from*\" and command_line like \"*base64*\") or\n command_line like \"*eval(*\"\n )\n )\n)\n| EVAL Esql.length_cmdline = LENGTH(command_line)\n| WHERE Esql.length_cmdline >= 4000\n| KEEP *" }, { "name": "7e5c0e5a-95a5-404e-a5b0-278d35dc3325 — AWS EC2 Stop, Start, and User Data Modification Correlation", "description": "(ESQL) Identifies a short sequence of EC2 management APIs against the same instance that is consistent with modifying instance user data and forcing it to run on the next boot: `ModifyInstanceAttribute` with user data, followed by stop and start. Adversaries may update `userData` and cycle instance state so malicious scripts execute as root on Linux or as the system context on Windows... (Source: Elastic's official detection-rules repository (Elastic License v2).)", "query": "FROM logs-aws.cloudtrail-* \n| WHERE event.provider == \"ec2.amazonaws.com\" \n and event.outcome == \"success\"\n and aws.cloudtrail.user_identity.type != \"AWSService\"\n and not (\n user_agent.original like \"*Terraform*\"\n or user_agent.original like \"*Ansible*\"\n or user_agent.original like \"*Pulumi*\"\n ) and not source.address in (\"cloudformation.amazonaws.com\", \"servicecatalog.amazonaws.com\")\n and\n (\n event.action in (\"StopInstances\", \"StartInstances\") or \n (event.action == \"ModifyInstanceAttribute\" and aws.cloudtrail.request_parameters like \"*userData=*\")\n )\n| grok aws.cloudtrail.request_parameters \"\"\"instanceId=(?[^,}\\]]+)\"\"\"\n| STATS Esql.event_action_unique_count = COUNT_DISTINCT(event.action), \n Esql.event_action_values = VALUES(event.action) by Esql.instance_id, user.name, cloud.account.id, Esql.time_bucket = DATE_TRUNC(5 minute, @timestamp) , user_agent.original, source.ip, source.as.organization.name, source.geo.country_name\n| where Esql.event_action_unique_count == 3\n| Keep Esql.*, user.name, cloud.account.id, user_agent.original, source.ip, source.as.organization.name, source.geo.country_name" } ] }, "automation": { "safe": [ "Add recommendation as Sentinel incident comment.", "Kill an isolated malicious process on a non-critical host after triage.", "Run enrichment queries." ], "approval_required": [ "Isolate the host.", "Apply a new AppLocker/WDAC restriction tenant- or fleet-wide." ] }, "escalation_criteria": [ "Encoded/obfuscated command line reaching out to an external host.", "Interpreter spawned from an unusual parent (Office app, browser, scheduled task).", "Activity on a server holding sensitive data or privileged access.", "Matches known offensive tooling signatures (C2 frameworks, credential dumping scripts)." ], "false_positive_considerations": [ "Intune / Endpoint Manager deployment scripts — Exclude by signed parent process (Microsoft.Management.Services.IntuneWindowsAgent.exe)", "Azure Arc management commands — Exclude by AzureConnectedMachineAgent.exe parent — already in KnownGoodParents", "IT team automation (Ansible WinRM, Chef) — Exclude by specific management server IP initiating the WinRM session" ], "confluence": { "title": "T1059 - Command and Scripting Interpreter Response Guidance", "labels": [ "mitre", "attack", "d3fend", "secops", "basyrix" ], "sections": [ "summary", "d3fend_mappings", "investigation_steps", "response_actions", "queries", "automation", "escalation_criteria", "false_positive_considerations" ] } }