ATT&CK coverage › Technique
Command and Scripting Interpreter T1059
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.
Events covered
35 catalog events are tagged with this technique by at least one rule.
Authoring guide
Patterns shared across the 94 rules above: which fields they filter on, what specific values they look for, and what they exclude. Field names are normalized across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.
Fields filtered most (35 distinct)
The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.
Top indicator values (536 distinct)
Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique.
Common exclusions (12 distinct)
Field/operator/value combinations that rules under this technique routinely exclude (top-level not() clauses). These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths.
Rules under this technique
Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.
Sigma 57 rules
- Abusable DLL Potential Sideloading From Suspicious Location
- Add Insecure Download Source To Winget
- Add New Download Source To Winget
- Add Potential Suspicious New Download Source To Winget
- Clfs.SYS Loaded By Process Located In a Potential Suspicious Location
- Conhost Spawned By Uncommon Parent Process
- Elevated System Shell Spawned From Uncommon Parent Location
- Forfiles Command Execution
- HackTool - Sliver C2 Implant Activity Pattern
- HackTool - Stracciatella Execution
- Hacktool Ruler
- Install New Package Via Winget Local Manifest
- Installation of WSL Kali-Linux
- Outlook EnableUnsafeClientMailRules Setting Enabled
- PCRE.NET Package Image Load
- PCRE.NET Package Temp Files
- Perl Inline Command Execution
- Php Inline Command Execution
- Potential Arbitrary Command Execution Via FTP.EXE
- Potential CobaltStrike Process Patterns
- Potential Dosfuscation Activity
- Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script
- Potentially Suspicious Execution From Parent Process In Public Folder
- Potentially Suspicious NTFS Symlink Behavior Modification
- PowerShell Download and Execution Cradles
- PUA - Wsudo Suspicious Execution
- Python Inline Command Execution
- Python Spawning Pretty TTY on Windows
- Renamed CURL.EXE Execution
- Renamed FTP.EXE Execution
- Renamed NirCmd.EXE Execution
- Renamed PingCastle Binary Execution
- Ruby Inline Command Execution
- Run PowerShell Script from Redirected Input Stream
- Script Interpreter Execution From Suspicious Folder
- Suspicious ArcSOC.exe Child Process
- Suspicious File Created In PerfLogs
- Suspicious Greedy Compression Using Rar.EXE
- Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script
- Suspicious Program Names
- Suspicious RASdial Activity
- Suspicious Remote Child Process From Outlook
- Suspicious Runscripthelper.exe
- Suspicious Scan Loop Network
- Suspicious Script Execution From Temp Folder
- Sysprep on AppData Folder
- Unusual Parent Process For Cmd.EXE
- Use of FSharp Interpreters
- Use of OpenConsole
- Use of Pcalua For Execution
- VMToolsd Suspicious Child Process
- Windows Defender AMSI Trigger Detected
- Windows Defender Exclusions Added - PowerShell
- Windows Defender Threat Detected
- Windows Shell/Scripting Application File Write to Suspicious Folder
- Writing Of Malicious Files To The Fonts Folder
- Wscript Shell Run In CommandLine
Elastic 12 rules
- Dynamic IEX Reconstruction via Method String Access
- Potential Dynamic IEX Reconstruction via Environment Variables
- Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion
- Potential PowerShell Obfuscation via Character Array Reconstruction
- Potential PowerShell Obfuscation via Concatenated Dynamic Command Invocation
- Potential PowerShell Obfuscation via High Numeric Character Proportion
- Potential PowerShell Obfuscation via Invalid Escape Sequences
- Potential PowerShell Obfuscation via Reverse Keywords
- Potential PowerShell Obfuscation via Special Character Overuse
- Potential PowerShell Obfuscation via String Concatenation
- Potential PowerShell Obfuscation via String Reordering
- PowerShell Obfuscation via Negative Index String Reversal
Splunk 4 rules
- Process Writing DynamicWrapperX
- Windows Defender ASR Audit Events
- Windows Defender ASR Block Events
- Windows Defender ASR Rules Stacking
Kusto Query Language 21 rules
- Base64 encoded Windows process command-lines (Normalized Process Events)
- Deimos Component Execution
- Detect Suspicious Commands Initiated by Webserver Processes
- Doppelpaymer Stop Services
- Google Threat Intelligence - Threat Hunting Hash
- Java Executing cmd to run Powershell
- Midnight Blizzard - Script payload stored in Registry
- NRT Base64 Encoded Windows Process Command-lines
- NRT Process executed from binary hidden in Base64 encoded file
- Office Apps Launching Wscipt
- Powershell Empire Cmdlets Executed in Command Line
- Qakbot Discovery Activies
- RecordedFuture Threat Hunting Hash All Actors
- SUNBURST and SUPERNOVA backdoor hashes
- SUNBURST and SUPERNOVA backdoor hashes (Normalized File Events)
- SUNBURST network beacons
- SUNBURST suspicious SolarWinds child processes (Normalized Process Events)
- Suspicious Powershell Commandlet Executed
- TEARDROP memory-only dropper
- Windows Binaries Executed from Non-Default Directory
- Windows Binaries Lolbins Renamed