T1059.005sub-technique of T1059 Command and Scripting Interpreter
Visual Basic
Linux · macOS · Windowsnothing on this site yetT1059.005 on attack.mitre.org
Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows technologies such as Component Object Model and the Native API through the Windows API. Although tagged as legacy with no planned future evolutions, VB is integrated and supported in the.NET Framework and cross-platform.NET Core.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Suspicious execution on an endpoint
An EDR alert, an unexplained process, or a user reporting something odd.
how MITRE says to see it
Behavioral Detection of Visual Basic Execution (VBS/VBA/VBScript)
- Detects execution of VB-based scripts or macros (VBS/VBA/VBScript) through cscript.exe/wscript.exe, Office-based process chains, or HTA usage. Focuses on chained behavior: Office or HTML container spawns script host > script host spawns PowerShell, network connections, or process injection.
- Detects embedded or emulated VBScript/VBA execution via Wine-based apps, Office for Mac abusing cross-platform.NET features, or macros dropped and invoked via AppleScript or third-party automation tools.
- Detects abuse of Mono/.NET Core environments to execute VB-like scripts, often in environments with Office emulation or WINE. Focus is on rare invocations of scripting hosts like mono.exe or.NET shells, often seen in spam filtering or forensic labs with Office support.
what reduces it
- M1021 Restrict Web-Based Content. Script blocking extensions can help prevent the execution of scripts and HTA files that may commonly be used during the exploitation process. For malicious code served up through ads, adblockers can help prevent that code from executing in the first place.
- M1038 Execution Prevention. Use application control where appropriate. VBA macros obtained from the Internet, based on the file's Mark of the Web (MOTW) attribute, may be blocked from executing in Office applications (ex: Access, Excel, PowerPoint, Visio, and Word) by default starting in Windows Version 2203.
- M1040 Behavior Prevention on Endpoint. On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent Visual Basic scripts from executing potentially malicious downloaded content.
- M1049 Antivirus/Antimalware. Anti-virus can be used to automatically quarantine suspicious files.
- M1042 Disable or Remove Feature or Program. Turn off or restrict access to unneeded VB components.