T1059 — Command and Scripting Interpreter

# T1059 - Command and Scripting Interpreter

## SOC Recommendation
Treat unusual interpreter activity — especially PowerShell with encoded or obfuscated arguments, spawned from an unexpected parent process, or reaching out to the network — as probable execution of attacker tooling rather than routine administration until the parent process, argument content, and operator are validated.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| File Analysis | Detect | Analyze the script/interpreter's file and arguments for encoded or obfuscated content and known offensive-tooling patterns. |
| Dynamic Analysis | Detect | Detonate or sandbox-execute the script to observe its real runtime behavior (network calls, child processes, file writes) beyond what static inspection of the command line shows. |
| Executable Allowlisting | Isolate | Apply Constrained Language Mode / AppLocker / WDAC allowlisting to restrict which interpreters and scripts are permitted to run. |
| Executable Denylisting | Isolate | Block known-malicious interpreter/script hashes or paths from executing. |

## Investigation Steps
1. where RegistryKey has_any ("CurrentVersion\\Run","Services","Scheduled")
2. where ActionType in ("RegistryKeyCreated","RegistryValueSet")
3. project Timestamp, RegistryKey, RegistryValueName, RegistryValueData

## Evidence to Collect
- Host and user
- Interpreter binary and full command line
- Parent process chain
- Decoded script content
- Network connections made during/after execution
- Files written or modified

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Kill the PowerShell process via MDE Live Response: kill <PI | Low | No | Yes |
| Block download URL and C2 IP in MDE custom indicators | Medium | No | Yes |
| Quarantine any dropped files (SHA256 block) | Medium | No | Yes |
| Isolate device if payload downloaded or executed | Medium | No | Yes |
| Enable PowerShell Constrained Language Mode via GPO | Low | No | Yes |
| Enable Script Block Logging via Group Policy (records all Po | Medium | No | Yes |
| Consider enabling AMSI (Antimalware Scan Interface) enforcem | Low | No | Yes |

## KQL
```kql
let KnownGoodParents = dynamic([
    "devenv.exe", "msbuild.exe", "AzurePowerShell.exe",
    "AzureAD.exe", "AzureConnectedMachineAgent.exe"
]);
DeviceProcessEvents
| where TimeGenerated >= ago(5m)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any (
    "-EncodedCommand", "-enc ",
    "IEX", "Invoke-Expression",
    "DownloadString", "DownloadFile", "DownloadData",
    "Net.WebClient", "System.Net.WebClient",
    "-ExecutionPolicy Bypass", "-ep bypass",
    "WindowStyle Hidden", "-w hidden",
    "FromBase64String", "[Convert]::",
    "Invoke-WebRequest", "Start-BitsTransfer", "Invoke-RestMethod",
    "New-Object System.Net.Sockets", "System.Net.Sockets"
)
| where not(InitiatingProcessFileName in~ (KnownGoodParents))
| project
    TimeGenerated, DeviceName, AccountName, AccountDomain,
    ProcessCommandLine, InitiatingProcessFileName,
    InitiatingProcessCommandLine, SHA256, FolderPath
| extend timestamp = TimeGenerated,
         HostCustomEntity = DeviceName,
         AccountCustomEntity = AccountName
| order by TimeGenerated desc
```
```kql
let SunburstMD5=dynamic(["b91ce2fa41029f6955bff20079468448","02af7cec58b9a5da1c542b5a32151ba1","2c4a910a1299cdae2a4e55988a2f102e","846e27a652a5e1bfbd0ddd38a16dc865","4f2eb62fa529c0283b28d05ddd311fae"]);
let SupernovaMD5="56ceb6d0011d87b6e4d7023d7ef85676";
imFileEvent
| where TargetFileMD5 in (SunburstMD5) or TargetFileMD5 in (SupernovaMD5)
| extend AccountName = tostring(split(User, @'\')[1]), AccountNTDomain = tostring(split(User, @'\')[0])
| extend AlgorithmType = "MD5"
```
```kql
let Threshold = 3;
AzureDiagnostics
| where Category == "ApplicationGatewayFirewallLog"
| where action_s == "Matched"
| project transactionId_g, hostname_s, requestUri_s, TimeGenerated, clientIp_s, Message, details_message_s, details_data_s
| join kind = inner(
AzureDiagnostics
| where Category == "ApplicationGatewayFirewallLog"
| where action_s == "Blocked"
| parse Message with MessageText 'Total Inbound Score: ' TotalInboundScore ' - SQLI=' SQLI_Score ',XSS=' XSS_Score ',RFI=' RFI_Score ',LFI=' LFI_Score ',RCE=' RCE_Score ',PHPI=' PHPI_Score ',HTTP=' HTTP_Score ',SESS=' SESS_Score '): ' Blocked_Reason '; individual paranoia level scores:' Paranoia_Score
| where Blocked_Reason contains "SQL Injection Attack" and toint(SQLI_Score) >=10 and toint(TotalInboundScore) >= 15) on transactionId_g
| extend Uri = strcat(hostname_s,requestUri_s)
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TransactionID = make_set(transactionId_g), Message = make_set(Message), Detail_Message = make_set(details_message_s), Detail_Data = make_set(details_data_s), Total_TransactionId = dcount(transactionId_g) by clientIp_s, Uri, action_s, SQLI_Score, TotalInboundScore
| where Total_TransactionId >= Threshold
```

## Escalation Criteria
- Encoded/obfuscated command line reaching out to an external host.
- Interpreter spawned from an unusual parent (Office app, browser, scheduled task).
- Activity on a server holding sensitive data or privileged access.
- Matches known offensive tooling signatures (C2 frameworks, credential dumping scripts).

## False Positive Considerations
- Intune / Endpoint Manager deployment scripts — Exclude by signed parent process (Microsoft.Management.Services.IntuneWindowsAgent.exe)
- Azure Arc management commands — Exclude by AzureConnectedMachineAgent.exe parent — already in KnownGoodParents
- IT team automation (Ansible WinRM, Chef) — Exclude by specific management server IP initiating the WinRM session

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1059.json
• /api/recommendations/T1059.json
• /api/d3fend/T1059.json
• /api/mappings/T1059.json
• /api/confluence/T1059.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1059.json

Response:

{
  "technique_id": "T1059",
  "name": "Command and Scripting Interpreter",
  "priority": "high",
  "status": "complete",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Execution"
  ],
  "platforms": [
    "Windows",
    "Linux",
    "macOS"
  ],
  "summary": "Adversaries may abuse command and script interpreters (PowerShell, cmd, bash, Python, JavaScript/JScript, VBScript) to execute commands, scripts, or binaries as part of initial execution, lateral movement, or post-exploitation tooling.\n",
  "soc_recommendation": "Treat unusual interpreter activity — especially PowerShell with encoded or obfuscated arguments, spawned from an unexpected parent process, or reaching out to the network — as probable execution of attacker tooling rather than routine administration until the parent process, argument content, and operator are validated.\n",
  "d3fend_mappings": [
    {
      "id": "D3-FA",
      "name": "File Analysis",
      "relationship": "detect",
      "practical_action": "Analyze the script/interpreter's file and arguments for encoded or obfuscated content and known offensive-tooling patterns.\n",
      "tooling": [
        "Defender for Endpoint",
        "Sentinel"
      ]
    },
    {
      "id": "D3-DA",
      "name": "Dynamic Analysis",
      "relationship": "detect",
      "practical_action": "Detonate or sandbox-execute the script to observe its real runtime behavior (network calls, child processes, file writes) beyond what static inspection of the command line shows.\n",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-EAL",
      "name": "Executable Allowlisting",
      "relationship": "isolate",
      "practical_action": "Apply Constrained Language Mode / AppLocker / WDAC allowlisting to restrict which interpreters and scripts are permitted to run.\n",
      "tooling": [
        "AppLocker",
        "WDAC"
      ]
    },
    {
      "id": "D3-EDL",
      "name": "Executable Denylisting",
      "relationship": "isolate",
      "practical_action": "Block known-malicious interpreter/script hashes or paths from executing.",
      "tooling": [
        "AppLocker",
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "where RegistryKey has_any (\"CurrentVersion\\\\Run\",\"Services\",\"Scheduled\")",
      "where ActionType in (\"RegistryKeyCreated\",\"RegistryValueSet\")",
      "project Timestamp, RegistryKey, RegistryValueName, RegistryValueData"
    ],
    "generic": [
      "Identify the interpreter, its arguments, and its parent process.",
      "Decode/deobfuscate any encoded command-line arguments.",
      "Determine whether the script or command matches known offensive tooling patterns.",
      "Check for follow-on network connections, file writes, or child processes.",
      "Real detection reference: \"Suspicious PowerShell Encoded Command or Download Cradle\" -- Flags PowerShell launched with flags commonly abused to download and execute payloads: encoded commands, download cradles (IEX/DownloadString/WebClient), execution policy bypass, or hidden window mode."
    ]
  },
  "evidence_to_collect": [
    "Host and user",
    "Interpreter binary and full command line",
    "Parent process chain",
    "Decoded script content",
    "Network connections made during/after execution",
    "Files written or modified"
  ],
  "response_actions": [
    {
      "name": "Kill the PowerShell process via MDE Live Response: kill <PI",
      "category": "Containment",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "Defender for Endpoint",
      "notes": "Kill the PowerShell process via MDE Live Response: kill <PID>"
    },
    {
      "name": "Block download URL and C2 IP in MDE custom indicators",
      "category": "Containment",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "Defender for Endpoint"
    },
    {
      "name": "Quarantine any dropped files (SHA256 block)",
      "category": "Containment",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    },
    {
      "name": "Isolate device if payload downloaded or executed",
      "category": "Containment",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    },
    {
      "name": "Enable PowerShell Constrained Language Mode via GPO",
      "category": "Response",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    },
    {
      "name": "Enable Script Block Logging via Group Policy (records all Po",
      "category": "Response",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Enable Script Block Logging via Group Policy (records all PowerShell content)"
    },
    {
      "name": "Consider enabling AMSI (Antimalware Scan Interface) enforcem",
      "category": "Response",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Consider enabling AMSI (Antimalware Scan Interface) enforcement"
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "GEN-EX-001 — Suspicious PowerShell Encoded Command or Download Cradle",
        "description": "Flags PowerShell launched with flags commonly abused to download and execute payloads: encoded commands, download cradles (IEX/DownloadString/WebClient), execution policy bypass, or hidden window mode. (Source: Bell Integration baseline detection library, mapped via sub-technique T1059.001.)",
        "query": "let KnownGoodParents = dynamic([\n    \"devenv.exe\", \"msbuild.exe\", \"AzurePowerShell.exe\",\n    \"AzureAD.exe\", \"AzureConnectedMachineAgent.exe\"\n]);\nDeviceProcessEvents\n| where TimeGenerated >= ago(5m)\n| where FileName in~ (\"powershell.exe\", \"pwsh.exe\")\n| where ProcessCommandLine has_any (\n    \"-EncodedCommand\", \"-enc \",\n    \"IEX\", \"Invoke-Expression\",\n    \"DownloadString\", \"DownloadFile\", \"DownloadData\",\n    \"Net.WebClient\", \"System.Net.WebClient\",\n    \"-ExecutionPolicy Bypass\", \"-ep bypass\",\n    \"WindowStyle Hidden\", \"-w hidden\",\n    \"FromBase64String\", \"[Convert]::\",\n    \"Invoke-WebRequest\", \"Start-BitsTransfer\", \"Invoke-RestMethod\",\n    \"New-Object System.Net.Sockets\", \"System.Net.Sockets\"\n)\n| where not(InitiatingProcessFileName in~ (KnownGoodParents))\n| project\n    TimeGenerated, DeviceName, AccountName, AccountDomain,\n    ProcessCommandLine, InitiatingProcessFileName,\n    InitiatingProcessCommandLine, SHA256, FolderPath\n| extend timestamp = TimeGenerated,\n         HostCustomEntity = DeviceName,\n         AccountCustomEntity = AccountName\n| order by TimeGenerated desc"
      },
      {
        "name": "bc5ffe2a-84d6-48fe-bc7b-1055100469bc — SUNBURST and SUPERNOVA backdoor hashes (Normalized File Events)",
        "description": "Identifies SolarWinds SUNBURST and SUPERNOVA backdoor file hash IOCs in File Events To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimFileEvent) References: - https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html - https://gist.github.com/olafhartong/71ffdd4cab4b6acd5cbcd1a0691ff82f (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "let SunburstMD5=dynamic([\"b91ce2fa41029f6955bff20079468448\",\"02af7cec58b9a5da1c542b5a32151ba1\",\"2c4a910a1299cdae2a4e55988a2f102e\",\"846e27a652a5e1bfbd0ddd38a16dc865\",\"4f2eb62fa529c0283b28d05ddd311fae\"]);\nlet SupernovaMD5=\"56ceb6d0011d87b6e4d7023d7ef85676\";\nimFileEvent\n| where TargetFileMD5 in (SunburstMD5) or TargetFileMD5 in (SupernovaMD5)\n| extend AccountName = tostring(split(User, @'\\')[1]), AccountNTDomain = tostring(split(User, @'\\')[0])\n| extend AlgorithmType = \"MD5\""
      },
      {
        "name": "68c0b6bb-6bd9-4ef4-9011-08998c8ef90f — Application Gateway WAF - SQLi Detection",
        "description": "Identifies a match for SQL Injection attack in the Application gateway WAF logs. The Threshold value in the query can be changed as per your infrastructure's requirement. References: https://owasp.org/Top10/A03_2021-Injection/' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "let Threshold = 3;\nAzureDiagnostics\n| where Category == \"ApplicationGatewayFirewallLog\"\n| where action_s == \"Matched\"\n| project transactionId_g, hostname_s, requestUri_s, TimeGenerated, clientIp_s, Message, details_message_s, details_data_s\n| join kind = inner(\nAzureDiagnostics\n| where Category == \"ApplicationGatewayFirewallLog\"\n| where action_s == \"Blocked\"\n| parse Message with MessageText 'Total Inbound Score: ' TotalInboundScore ' - SQLI=' SQLI_Score ',XSS=' XSS_Score ',RFI=' RFI_Score ',LFI=' LFI_Score ',RCE=' RCE_Score ',PHPI=' PHPI_Score ',HTTP=' HTTP_Score ',SESS=' SESS_Score '): ' Blocked_Reason '; individual paranoia level scores:' Paranoia_Score\n| where Blocked_Reason contains \"SQL Injection Attack\" and toint(SQLI_Score) >=10 and toint(TotalInboundScore) >= 15) on transactionId_g\n| extend Uri = strcat(hostname_s,requestUri_s)\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TransactionID = make_set(transactionId_g), Message = make_set(Message), Detail_Message = make_set(details_message_s), Detail_Data = make_set(details_data_s), Total_TransactionId = dcount(transactionId_g) by clientIp_s, Uri, action_s, SQLI_Score, TotalInboundScore\n| where Total_TransactionId >= Threshold"
      }
    ],
    "spl": [
      {
        "name": "Encoded PowerShell execution",
        "description": "Search for encoded PowerShell command lines.",
        "query": "index=endpoint process_name=powershell.exe earliest=-24h\n| search process_command_line=\"*-enc*\" OR process_command_line=\"*EncodedCommand*\"\n"
      }
    ],
    "esql": [
      {
        "name": "74d31cb7-4a2c-44fe-9d1d-f375b9f3cb61 — Long Base64 Encoded Command via Scripting Interpreter",
        "description": "(ESQL) Identifies oversized command lines used by Python, PowerShell, Node.js, or Deno that contain base64 decoding or encoded-command patterns. Adversaries may embed long inline encoded payloads in scripting interpreters to evade inspection and execute malicious content across Windows, macOS, and Linux systems. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "FROM logs-endpoint.events.process-* METADATA _id, _index, _version, _ignored\n| MV_EXPAND _ignored\n| WHERE _ignored == \"process.command_line\"\n| WHERE event.category == \"process\" and event.type == \"start\"\n| EVAL command_line = TO_LOWER(process.command_line.text), pname = TO_LOWER(process.name)\n| WHERE \n(\n    (\n        /* Python: inline exec with base64 decode or -c flag with encoded payload */\n        pname like \"python*\" and\n        (\n            command_line like \"*b64decode*\" or\n            (command_line like \"*-c*\" and command_line like \"*base64*\")\n        )\n    ) or\n    (\n        /* PowerShell: encoded command flag — require trailing space to avoid matching\n           -Encoding, -EncryptionType, -EncryptionProvider, etc. */\n        (pname like \"powershell*\" or pname like \"pwsh*\") and\n        (\n            command_line rlike \".* -(e|en|enc|enco|encod|encode|encoded|encodedcommand) .+\" or\n            command_line like \"*-encodedcommand*\" or\n            command_line like \"*frombase64string*\"\n        )\n    ) or\n    (\n        /* Node.js: buffer.from must be paired with base64 to avoid matching\n           general Buffer usage; atob is always base64 */\n        pname like \"node*\" and\n        (\n            (command_line like \"*buffer.from*\" and command_line like \"*base64*\") or\n            command_line like \"*atob(*\"\n        )\n    ) or\n    (\n        /* Deno: eval( (not eval/evaluate/evaluation), atob, or buffer+base64 */\n        pname like \"deno*\" and\n        (\n            command_line like \"*atob(*\" or\n            (command_line like \"*buffer.from*\" and command_line like \"*base64*\") or\n            command_line like \"*eval(*\"\n        )\n    )\n)\n| EVAL Esql.length_cmdline = LENGTH(command_line)\n| WHERE Esql.length_cmdline >= 4000\n| KEEP *"
      },
      {
        "name": "7e5c0e5a-95a5-404e-a5b0-278d35dc3325 — AWS EC2 Stop, Start, and User Data Modification Correlation",
        "description": "(ESQL) Identifies a short sequence of EC2 management APIs against the same instance that is consistent with modifying instance user data and forcing it to run on the next boot: `ModifyInstanceAttribute` with user data, followed by stop and start. Adversaries may update `userData` and cycle instance state so malicious scripts execute as root on Linux or as the system context on Windows... (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "FROM logs-aws.cloudtrail-* \n| WHERE event.provider == \"ec2.amazonaws.com\" \n    and event.outcome == \"success\"\n    and aws.cloudtrail.user_identity.type != \"AWSService\"\n    and not (\n      user_agent.original like \"*Terraform*\"\n      or user_agent.original like \"*Ansible*\"\n      or user_agent.original like \"*Pulumi*\"\n    ) and not source.address in (\"cloudformation.amazonaws.com\", \"servicecatalog.amazonaws.com\")\n    and\n  (\n   event.action in (\"StopInstances\", \"StartInstances\") or \n   (event.action == \"ModifyInstanceAttribute\" and aws.cloudtrail.request_parameters like \"*userData=*\")\n   )\n| grok aws.cloudtrail.request_parameters \"\"\"instanceId=(?<Esql.instance_id>[^,}\\]]+)\"\"\"\n| STATS Esql.event_action_unique_count = COUNT_DISTINCT(event.action), \n        Esql.event_action_values = VALUES(event.action) by Esql.instance_id, user.name, cloud.account.id, Esql.time_bucket = DATE_TRUNC(5 minute, @timestamp) , user_agent.original, source.ip, source.as.organization.name, source.geo.country_name\n| where Esql.event_action_unique_count == 3\n| Keep Esql.*, user.name, cloud.account.id, user_agent.original, source.ip, source.as.organization.name, source.geo.country_name"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Kill an isolated malicious process on a non-critical host after triage.",
      "Run enrichment queries."
    ],
    "approval_required": [
      "Isolate the host.",
      "Apply a new AppLocker/WDAC restriction tenant- or fleet-wide."
    ]
  },
  "escalation_criteria": [
    "Encoded/obfuscated command line reaching out to an external host.",
    "Interpreter spawned from an unusual parent (Office app, browser, scheduled task).",
    "Activity on a server holding sensitive data or privileged access.",
    "Matches known offensive tooling signatures (C2 frameworks, credential dumping scripts)."
  ],
  "false_positive_considerations": [
    "Intune / Endpoint Manager deployment scripts — Exclude by signed parent process (Microsoft.Management.Services.IntuneWindowsAgent.exe)",
    "Azure Arc management commands — Exclude by AzureConnectedMachineAgent.exe parent — already in KnownGoodParents",
    "IT team automation (Ansible WinRM, Chef) — Exclude by specific management server IP initiating the WinRM session"
  ],
  "confluence": {
    "title": "T1059 - Command and Scripting Interpreter Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}