Meta tags:

Headings (most frequently used words):

command, and, scripting, interpreter, procedure, examples, mitigations, detection, strategy, references, sub, techniques, 13,

Text of the page (most frequently used words):
retrieved (61), and (56), the (53), t1059 (28), #command (26), 2018 (21), used (21), 2024 (19), has (19), execution (18), may (18), for (18), can (18), shell (17), scripts (17), 2021 (16), commands (16), april (14), july (13), 2019 (13), powershell (12), 2017 (12), august (12), 2020 (12), with (12), execute (12), all (11), november (11), june (11), threat (11), windows (11), remote (11), scripting (11), line (11), att (10), february (10), 2016 (10), new (10), from (10), march (9), data (8), script (8), files (8), january (8), december (8), october (8), use (7), enterprise (7), techniques (7), 2022 (7), malware (7), panda (7), systems (7), operation (7), interpreter (7), interpreters (7), that (7), targeting (6), oilrig (6), uses (6), cyber (6), perl (6), executing (6), code (6), victim (6), reverse (6), are (5), ics (5), mobile (5), none (5), prevent (5), ransomware (5), government (5), espionage (5), group (5), zero (5), day (5), 2025 (5), payloads (5), through (5), network (5), access (5), cli (5), system (5), interface (5), 2026 (4), mitre (4), policy (4), software (4), detection (4), september (4), variant (4), actor (4), activity (4), enable (4), mustang (4), apt (4), actors (4), attacks (4), falcone (4), intelligence (4), rat (4), fivehands (4), fin7 (4), fin6 (4), cutting (4), edge (4), delivered (4), cisco (4), also (4), machine (4), python (4), via (4), detects (4), host (4), exe (4), arbitrary (4), shells (4), file (4), create (4), various (4), version (4), 2015 (3), groups (3), cti (3), mitigations (3), defenses (3), sub (3), microsoft (3), administration (3), 2014 (3), ways (3), language (3), mode (3), attack (3), zeus (3), iranian (3), winter (3), vivern (3), fireeye (3), apt37 (3), whitefly (3), targets (3), starproxy (3), check (3), speakup (3), linux (3), trojan (3), suspected (3), secure (3), include (3), raspberry (3), robin (3), intrusion (3), campaign (3), spalax (3), targeted (3), lee (3), using (3), ke3chang (3), gh0st (3), get2 (3), fox (3), kitten (3), donut (3), part (3), darkcomet (3), exploitation (3), bandook (3), arcanedoor (3), apt39 (3), capable (3), when (3), user (3), arguments (3), abuse (3), description (3), name (3), help (3), malicious (3), limit (3), such (3), remove (3), downloaded (3), javascript (3), visual (3), basic (3), initial (3), java (3), adversaries (3), corporation (2), domains (2), resources (2), reference (2), campaigns (2), components (2), analytics (2), strategies (2), assets (2), tactics (2), matrices (2), core (2), objects (2), just (2), enough (2), 2023 (2), bypass (2), team (2), constrained (2), surface (2), reduction (2), rules (2), analysis (2), results (2), against (2), organizations (2), languages (2), north (2), korean (2), scott (2), macros (2), point (2), research (2), pulse (2), document (2), downloader (2), provider (2), linked (2), cve (2), operations (2), deploys (2), eset (2), clearsky (2), orb (2), mclellan (2), ivanti (2), connect (2), vpn (2), signed (2), focused (2), found (2), devices (2), associated (2), information (2), cobalt (2), ios (2), history (2), sessions (2), ssh (2), terminal (2), launch (2), especially (2), process (2), initiated (2), applications (2), users (2), processes (2), suspicious (2), cmd (2), wscript (2), obfuscated (2), secondary (2), analytic (2), commonly (2), during (2), restrict (2), web (2), based (2), content (2), there (2), environment (2), installation (2), where (2), example (2), those (2), prevention (2), disable (2), feature (2), installations (2), receive (2), zerocleare (2), winerack (2), windigo (2), back (2), server (2), versamem (2), stealth (2), falcon (2), slightpulse (2), saint (2), bear (2), ability (2), webshell (2), install (2), types (2), provided (2), nicecurl (2), utilized (2), meterpreter (2), shellcode (2), launched (2), muddyviper (2), matryoshka (2), infected (2), specified (2), kessel (2), run (2), imminent (2), monitor (2), open (2), florahox (2), perform (2), fin5 (2), empire (2), dragonfly (2), ruby (2), chopstick (2), bonadan (2), apt32 (2), apt19 (2), macos (2), platforms (2), 013 (2), 012 (2), 011 (2), 010 (2), 009 (2), 008 (2), 007 (2), 006 (2), 005 (2), 004 (2), 003 (2), 002 (2), 001 (2), these (2), well (2), some (2), unix (2), api (2), ckcon (2), person (2), tickets (2), faq (2), registered, trademarks, cookie, preferences, website, changelog, privacy, terms, contact, reset, filters, sutherland, infection, ebach, jenkins, roadsweep, likely, conducts, politically, motivated, disruptive, albanian, chad, anderson, look, crafted, maldocs, multiple, reaper, overlooked, symantec, singapore, its, sights, black, lotus, labs, taking, crossroads, versa, director, exploitaiton, marczak, railton, keep, calm, don, uae, dissidents, sudeep, singh, latest, arsenal, toneshell, undetected, backdoor, perez, your, leverage, authentication, unit, spear, phishing, target, ukraine, stealer, outsteel, saintbot, patrick, schläpfer, now, spreading, anssi, sandworm, set, centreon, porolli, colombia, wilhoit, analyzing, ops, tempo, testing, weaponization, delivery, technology, service, agency, quadagent, oopsie, threedollars, deliver, ismdoor, possibly, greenbug, sardiwal, middle, east, apt34, 11882, exploit, rozmann, uncharmed, untangling, iran, apt42, asheer, malhotra, jungsoo, kendall, wave, europe, muddywater, snakes, riverbank, security, trend, micro, wilted, tulip, exposing, apparatus, smallridge, apt15, alive, strong, royalcli, royaldns, villeneuve, bennett, moran, haq, geers, ministries, foreign, affairs, qianxin, center, continuous, colombian, institutions, corporations, pantazopoulos, decoding, demonstrating, hustle, chinese, quickly, vulnerability, 5119, following, hacking, leak, schwarz, ta505, distributes, sdbbot, pay2key, raggi, michael, ioc, extinction, china, nexus, networks, raise, cost, defenders, matthews, backhouse, handy, guide, moore, unc2447, sombrat, sophisticated, financial, platt, reeves, revisited, inside, astra, panel, sqlrat, carr, hunt, pursuing, enigmatic, evasive, global, criminal, mckeague, pick, six, intercepting, recently, tied, ryuk, lockergoga, follow, money, dissecting, crime, bromiley, lewis, attacking, hospitality, gaming, industries, tracking, attacker, around, world, years, schroeder, warner, nelson, github, powershellempire, cert, alert, ta18, 074a, russian, energy, other, critical, infrastructure, sectors, thewover, kujawa, you, dirty, lin, investigating, route, sednit, observing, comings, goings, alperovitch, bears, midst, into, democratic, national, committee, dumont, léveillé, porcher, dark, side, forsshe, landscape, openssh, backdoors, talos, perimeter, fbi, indicators, compromise, rana, computing, known, advanced, persistent, chafer, cadelspy, remexi, itg07, hawley, personal, cash, grunzweig, adair, lancaster, bluelight, special, inkysquid, rokrat, dahan, kitty, ahl, privileges, credentials, phished, request, counsel, abdou, rockikz, how, integrity, assurance, running, references, identifies, juniper, junos, uncommon, accounts, unknown, ips, an1432, esxcli, direct, busybox, invoked, unexpectedly, an1431, automator, hidden, parent, lineage, deviates, osascript, an1430, bash, not, normally, them, chaining, utilities, like, netcat, curl, an1429, outside, expected, administrative, time, abnormal, contexts, often, followed, encoded, events, an1428, behavioral, det0516, strategy, blocking, extensions, hta, served, ads, adblockers, first, place, m1021, jea, sandbox, what, admins, necessary, consider, restricting, administrators, aware, methods, bypassing, depending, configuration, privileged, account, management, m1026, unrequired, m1033, application, control, appropriate, sensitive, otherwise, dangerous, elements, apis, add, type, m1038, any, unnecessary, unused, program, m1042, possible, only, permit, signing, m1045, asr, potentially, behavior, endpoint, m1040, inventory, unauthorized, audit, m1047, anti, virus, automatically, quarantine, antivirus, antimalware, m1049, mitigation, s0330, operator, corrupt, driver, rawdisk, s1151, xlm, g1035, utilizes, statically, wine, emulate, prompt, s0219, gathering, g0124, simple, tool, will, call, wait, g0107, was, archive, jar, runs, attaching, itself, apache, tomcat, servlet, s1154, wmi, collection, g0038, s1227, s0374, contains, functionality, passed, s1110, intermediate, written, machines, g1031, variants, highly, wsf, s1130, s0598, nullsoft, scriptable, nsis, c0005, g0049, s1192, g0129, s9032, providing, s0167, between, s0487, g0004, commandpromptpacket, scriptpacket, module, creating, s0434, able, s0032, executables, s0460, communicate, g0117, executed, php, identify, infect, subsequent, routers, c0053, argument, encryption, directories, s0618, sql, tasks, g0046, iterate, list, compromised, pos, copy, log, original, g0037, scans, automated, pull, g0053, interact, s0363, g0035, generate, outputs, s0695, s0334, deployment, thinspool, dropper, enumerating, c0029, performing, s0023, bind, s0486, support, s0234, included, adversary, c0046, custom, internal, reconnaissance, g0087, g0067, com, scriptlets, download, strike, beacons, g0050, within, sct, g0073, procedure, examples, live, permalink, last, modified, created, containers, esxi, iaas, identity, office, suite, saas, tactic, technologies, means, embedded, victims, lure, documents, existing, interactive, terminals, utilize, order, achieve, services, cross, platform, client, binaries, interfaces, provide, interacting, computer, common, across, many, different, most, come, built, capabilities, distributions, flavor, while, container, hypervisor, lua, autohotkey, autoit, cloud, device, applescript, home, join, mclean, hotel, location, details, register, here, search, blog, contribute, benefactors, legal, branding, updates, engage, tools, advisory, council, learn, more, about, get, started, detections, technique,

Text of the page (random words):
adversaries may abuse these technologies in various ways as a means of executing arbitrary commands commands and scripts can be embedded in initial access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing c2 adversaries may also execute commands through interactive terminals shells as well as utilize various remote services in order to achieve remote execution 1 2 3 id t1059 sub techniques t1059 001 t1059 002 t1059 003 t1059 004 t1059 005 t1059 006 t1059 007 t1059 008 t1059 009 t1059 010 t1059 011 t1059 012 t1059 013 ⓘ tactic execution ⓘ platforms containers esxi iaas identity provider linux network devices office suite saas windows macos version 2 7 created 31 may 2017 last modified 12 may 2026 version permalink live version procedure examples id name description g0073 apt19 apt19 downloaded and launched code within a sct file 4 g0050 apt32 apt32 has used com scriptlets to download cobalt strike beacons 5 g0067 apt37 apt37 has used ruby scripts to execute payloads 6 g0087 apt39 apt39 has utilized custom scripts to perform internal reconnaissance 7 8 c0046 arcanedoor arcanedoor included the adversary executing command line interface cli commands 9 s0234 bandook bandook can support commands to execute java based payloads 10 s0486 bonadan bonadan can create bind and reverse shells on the infected system 11 s0023 chopstick chopstick is capable of performing remote command execution 12 13 c0029 cutting edge during cutting edge threat actors used perl scripts to enable the deployment of the thinspool shell script dropper and for enumerating host data 14 15 s0334 darkcomet darkcomet can execute various types of scripts on the victim s machine 16 s0695 donut donut can generate shellcode outputs that execute via ruby 17 g0035 dragonfly dragonfly has used the command line for execution 18 s0363 empire empire uses a command line interface to interact with systems 19 g0053 fin5 fin5 scans processes on all victim systems in the environment and uses automated scripts to pull back the results 20 g0037 fin6 fin6 has used scripting to iterate through a list of compromised pos systems copy data to a log file and remove the original data files 21 22 g0046 fin7 fin7 used sql scripts to help perform tasks on the victim s machine 23 24 23 s0618 fivehands fivehands can receive a command line argument to limit file encryption to specified directories 25 26 c0053 florahox activity florahox activity has executed php and shell scripts to identify and infect subsequent routers for the orb network 27 g0117 fox kitten fox kitten has used a perl reverse shell to communicate with c2 28 s0460 get2 get2 has the ability to run executables with command line arguments 29 s0032 gh0st rat gh0st rat is able to open a remote shell to execute commands 30 31 s0434 imminent monitor imminent monitor has a commandpromptpacket and scriptpacket module s for creating a remote shell and executing scripts 32 g0004 ke3chang malware used by ke3chang can run commands on the command line interface 33 34 s0487 kessel kessel can create a reverse shell between the infected host and a specified system 11 s0167 matryoshka matryoshka is capable of providing meterpreter shell access 35 s9032 muddyviper muddyviper has launched a reverse shell using a provided command line 36 g0129 mustang panda mustang panda has utilized meterpreter shellcode 37 s1192 nicecurl nicecurl has provided an arbitrary command execution interface 38 g0049 oilrig oilrig has used various types of scripting for execution 39 40 41 42 43 c0005 operation spalax for operation spalax the threat actors used nullsoft scriptable install system nsis scripts to install malware 44 s0598 p a s webshell p a s webshell has the ability to create reverse shells with perl scripts 45 s1130 raspberry robin raspberry robin variants can be delivered via highly obfuscated windows script files wsf for initial execution 46 g1031 saint bear saint bear has used the windows script host wscript to execute intermediate files written to victim machines 47 s1110 slightpulse slightpulse contains functionality to execute arbitrary commands passed to it 48 s0374 speakup speakup uses perl scripts 49 s1227 starproxy starproxy has used the command line for execution of commands 50 g0038 stealth falcon stealth falcon malware uses wmi to script data collection and command execution on the victim 51 s1154 versamem versamem was delivered as a java archive jar that runs by attaching itself to the apache tomcat java servlet and web server 52 g0107 whitefly whitefly has used a simple remote shell tool that will call back to the c2 server and wait for commands 53 g0124 windigo windigo has used a perl script for information gathering 11 s0219 winerack winerack can create a reverse shell that utilizes statically linked wine cmd exe code to emulate windows command prompt commands 54 g1035 winter vivern winter vivern used xlm 4 0 macros for initial code execution for malicious document files 55 s1151 zerocleare zerocleare can receive command line arguments from an operator to corrupt the file system using the rawdisk driver 56 s0330 zeus panda zeus panda can launch remote scripts on the victim s machine 57 mitigations id mitigation description m1049 antivirus antimalware anti virus can be used to automatically quarantine suspicious files m1047 audit inventory systems for unauthorized command and scripting interpreter installations m1040 behavior prevention on endpoint on windows 10 enable attack surface reduction asr rules to prevent visual basic and javascript scripts from executing potentially malicious downloaded content 58 m1045 code signing where possible only permit execution of signed scripts m1042 disable or remove feature or program disable or remove any unnecessary or unused shells or interpreters m1038 execution prevention use application control where appropriate for example powershell constrained language mode can be used to restrict access to sensitive or otherwise dangerous language elements such as those used to execute arbitrary windows apis or files e g add type 59 m1033 limit software installation prevent user installation of unrequired command and scripting interpreters m1026 privileged account management when powershell is necessary consider restricting powershell execution policy to administrators be aware that there are methods of bypassing the powershell execution policy depending on environment configuration 60 powershell jea just enough administration may also be used to sandbox administration and limit what commands admins users can execute through remote powershell sessions 61 m1021 restrict web based content script blocking extensions can help prevent the execution of scripts and hta files that may commonly be used during the exploitation process for malicious code served up through ads adblockers can help prevent that code from executing in the first place detection strategy id name analytic id analytic description det0516 behavioral detection of command and scripting interpreter abuse an1428 detects the execution of scripting or command interpreters e g powershell exe cmd exe wscript exe outside expected administrative time windows or from abnormal user contexts often followed by encoded obfuscated arguments or secondary execution events an1429 detects use of shell interpreters e g bash sh python perl initiated by users or processes not normally executing them especially when chaining suspicious utilities like netcat curl or ssh an1430 detects launch of command line interpreters via terminal automator or hidden osascript especially when parent process lineage deviates from user initiated applications an1431 detects use of esxcli system or direct interpreter commands e g busybox shell invoked from ssh or host terminal unexpectedly an1432 identifies cli interpreter access e g cisco ios juniper junos via enable mode or scripting capable sessions used by uncommon accounts or from unknown ips references microsoft 2020 august 21 running remote commands retrieved july 26 2021 cisco n d cisco ios software integrity assurance command history retrieved october 21 2020 abdou rockikz 2020 july how to execute shell commands in a remote machine in python retrieved july 26 2021 ahl i 2017 june 06 privileges and credentials phished at the request of counsel retrieved may 17 2018 dahan a 2017 operation cobalt kitty retrieved december 27 2018 cash d grunzweig j adair s lancaster t 2021 august 25 north korean bluelight special inkysquid deploys rokrat retrieved october 1 2021 hawley et al 2019 january 29 apt39 an iranian cyber espionage group focused on personal information retrieved february 19 2019 fbi 2020 september 17 indicators of compromise associated with rana intelligence computing also known as advanced persistent threat 39 chafer cadelspy remexi and itg07 retrieved december 10 2020 cisco talos 2024 april 24 arcanedoor new espionage focused campaign found targeting perimeter network devices retrieved january 6 2025 check point 2020 november 26 bandook signed delivered retrieved may 31 2021 dumont r m léveillé m porcher h 2018 december 1 the dark side of the forsshe a landscape of openssh backdoors retrieved july 16 2020 alperovitch d 2016 june 15 bears in the midst intrusion into the democratic national committee retrieved august 3 2016 eset 2016 october en route with sednit part 2 observing the comings and goings retrieved november 21 2016 lin m et al 2024 january 31 cutting edge part 2 investigating ivanti connect secure vpn zero day exploitation retrieved february 27 2024 mclellan t et al 2024 january 12 cutting edge suspected apt targets ivanti connect secure vpn in new zero day exploitation retrieved february 27 2024 kujawa a 2018 march 27 you dirty rat part 1 darkcomet retrieved november 6 2018 thewover 2019 may 9 donut retrieved march 25 2022 us cert 2018 march 16 alert ta18 074a russian government cyber activity targeting energy and other critical infrastructure sectors retrieved june 6 2018 schroeder w warner j nelson m n d github powershellempire retrieved april 28 2016 bromiley m and lewis p 2016 october 7 attacking the hospitality and gaming industries tracking an attacker around the world in 7 years retrieved october 6 2017 fireeye threat intelligence 2016 april follow the money dissecting the operations of the cyber crime group fin6 retrieved november 17 2024 mckeague b et al 2019 april 5 pick six intercepting a fin6 intrusion an actor recently tied to ryuk and lockergoga ransomware retrieved april 17 2019 carr n et al 2018 august 01 on the hunt for fin7 pursuing an enigmatic and evasive global criminal operation retrieved august 23 2018 platt j and reeves j 2019 march fin7 revisited inside astra panel and sqlrat malware retrieved june 18 2019 mclellan t and moore j et al 2021 april 29 unc2447 sombrat and fivehands ransomware a sophisticated financial threat retrieved june 2 2021 matthews m and backhouse w 2021 june 15 handy guide to a new fivehands ransomware variant retrieved june 24 2021 raggi michael 2024 may 22 ioc extinction china nexus cyber espionage actors use orb networks to raise cost on defenders retrieved july 8 2024 clearsky 2020 december 17 pay2key ransomware a new campaign by fox kitten retrieved december 21 2020 schwarz d et al 2019 october 16 ta505 distributes new sdbbot remote access trojan with get2 downloader retrieved may 29 2020 fireeye threat intelligence 2015 july 13 demonstrating hustle chinese apt groups quickly use zero day vulnerability cve 2015 5119 following hacking team leak retrieved january 25 2016 pantazopoulos n 2018 april 17 decoding network data from a gh0st rat variant retrieved november 2 2018 qianxin threat intelligence center 2019 february 18 apt c 36 continuous attacks targeting colombian government institutions and corporations retrieved may 5 2020 villeneuve n bennett j t moran n haq t scott m geers k 2014 operation ke3chang targeted attacks against ministries of foreign affairs retrieved november 12 2014 smallridge r 2018 march 10 apt15 is alive and strong an analysis of royalcli and royaldns retrieved april 4 2018 clearsky cyber security and trend micro 2017 july operation wilted tulip exposing a cyber espionage apparatus retrieved august 21 2017 eset research 2025 december 2 muddywater snakes by the riverbank retrieved february 17 2026 asheer malhotra jungsoo an kendall mc 2022 may 5 mustang panda deploys a new wave of malware targeting europe retrieved august 4 2025 rozmann o et al 2024 may 1 uncharmed untangling iran s apt42 operations retrieved october 9 2024 sardiwal m et al 2017 december 7 new targeted attack in the middle east by apt34 a suspected iranian threat group using cve 2017 11882 exploit retrieved december 20 2017 falcone r and lee b 2017 july 27 oilrig uses ismdoor variant possibly linked to greenbug threat group retrieved january 8 2018 lee b falcone r 2018 february 23 oopsie oilrig uses threedollars to deliver new trojan retrieved july 16 2018 lee b falcone r 2018 july 25 oilrig targets technology service provider and government agency with quadagent retrieved august 9 2018 falcone r wilhoit k 2018 november 16 analyzing oilrig s ops tempo from testing to weaponization to delivery retrieved april 23 2019 m porolli 2021 january 21 operation spalax targeted malware attacks in colombia retrieved september 16 2022 anssi 2021 january 27 sandworm intrusion set campaign targeting centreon systems retrieved march 30 2021 patrick schläpfer 2024 april 10 raspberry robin now spreading through windows script files retrieved may 17 2024 unit 42 2022 february 25 spear phishing attacks target organizations in ukraine payloads include the document stealer outsteel and the downloader saintbot retrieved june 9 2022 perez d et al 2021 april 20 check your pulse suspected apt actors leverage authentication bypass techniques and pulse secure zero day retrieved february 5 2024 check point research 2019 february 4 speakup a new undetected backdoor linux trojan retrieved april 17 2019 sudeep singh 2025 april 16 latest mustang panda arsenal toneshell and starproxy p1 retrieved july 21 2025 marczak b and scott railton j 2016 may 29 keep calm and don t enable macros a new threat actor targets uae dissidents retrieved june 8 2016 black lotus labs 2024 august 27 taking the crossroads the versa director zero day exploitaiton retrieved august 27 2024 symantec 2019 march 6 whitefly espionage group has singapore in its sights retrieved may 26 2020 fireeye 2018 february 20 apt37 reaper the overlooked north korean actor retrieved november 17 2024 chad anderson 2021 april 27 winter vivern a look at re crafted government maldocs targeting multiple languages retrieved july 29 2024 jenkins l at al 2022 august 4 roadsweep ransomware likely iranian threat actor conducts politically motivated disruptive activity against albanian government organizations retrieved august 6 2024 ebach l 2017 june 22 analysis results of zeus variant panda retr...