T1059.007sub-technique of T1059 Command and Scripting Interpreter
JavaScript
Linux · macOS · Windows2 pieces on this siteT1059.007 on attack.mitre.org
Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser. JScript is the Microsoft implementation of the same scripting standard.
If this is happening now
Checklists and playbooks to open while the alert is still live.
A malicious package was installed
A registry advisory, a vendor alert or a dependency scanner says a package version you use was malicious, or a build or a developer laptop ran an install script it should not have.
Read
Analyses, case studies, guides, references and interview questions.
Evidence Gap Challenge No. 2: the proxy only kept the domain
A developer laptop, a package that should not have been installed, and a proxy that logged where the traffic went but not what was asked for. Work out what the truncation costs you, what you can still prove, and whether a full-URL log would have been worth what it costs to keep.
how MITRE says to see it
Cross-Platform Detection of JavaScript Execution Abuse
- Detects JavaScript execution through WSH (wscript.exe, cscript.exe) or HTA (mshta.exe), particularly when spawned from Office macros, web browsers, or abnormal user paths. Correlates script execution with outbound network activity or system modification.
- Detects JavaScript for Automation (JXA) via osascript or compiled scripts using OSAKit APIs. Flags execution involving system modification, inter-process scripting, or browser abuse.
- Detects Node.js or JavaScript interpreter execution from web shells, cron jobs, or local users. Correlates execution with reverse shell behavior, file modifications, or abnormal outbound connections.
what reduces it
- M1021 Restrict Web-Based Content. Script blocking extensions can help prevent the execution of JavaScript and HTA files that may commonly be used during the exploitation process. For malicious code served up through ads, adblockers can help prevent that code from executing in the first place.
- M1038 Execution Prevention. Denylist scripting where appropriate.
- M1040 Behavior Prevention on Endpoint. On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent JavaScript scripts from executing potentially malicious downloaded content.
- M1042 Disable or Remove Feature or Program. Turn off or restrict access to unneeded scripting components.