// MITRE ATT&CK
T1059 · Command and Scripting Interpreter
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and ...
¿Cómo detectarlo y mitigarlo?
La detección de Command and Scripting Interpreter parte de la telemetría de tu SIEM/EDR. Escribe una regla de detección con el generador Sigma, analiza logs sospechosos en el analizador de logs y sitúa la técnica en tu cobertura con la matriz ATT&CK.
Sub-técnicas (13)
T1059.001
PowerShell T1059.002
AppleScript T1059.003
Windows Command Shell T1059.004
Unix Shell T1059.005
Visual Basic T1059.006
Python T1059.007
JavaScript T1059.008
Network Device CLI T1059.009
Cloud API T1059.010
AutoHotKey & AutoIT T1059.011
Lua T1059.012
Hypervisor CLI T1059.013
Container CLI/API
PowerShell T1059.002
AppleScript T1059.003
Windows Command Shell T1059.004
Unix Shell T1059.005
Visual Basic T1059.006
Python T1059.007
JavaScript T1059.008
Network Device CLI T1059.009
Cloud API T1059.010
AutoHotKey & AutoIT T1059.011
Lua T1059.012
Hypervisor CLI T1059.013
Container CLI/API
Técnicas relacionadas
T1053.005
Scheduled Task T1047
Windows Management Instrumentation T1129
Shared Modules T1059.007
JavaScript T1053.007
Container Orchestration Job T1559.002
Dynamic Data Exchange T1204.002
Malicious File T1053.003
Cron
Scheduled Task T1047
Windows Management Instrumentation T1129
Shared Modules T1059.007
JavaScript T1053.007
Container Orchestration Job T1559.002
Dynamic Data Exchange T1204.002
Malicious File T1053.003
Cron
Fuente: MITRE ATT&CK®. ATT&CK es una marca registrada de The MITRE Corporation. Contenido con fines educativos.