type: attack-pattern
spec_version: 2.1
id: attack-pattern--dfd7cc1d-e1d8-4394-a198-97c4cab8aa67
created: 2020-03-09T14:29:51.508Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1059/005
external_id: T1059.005
source_name: VB .NET Mar 2020
description: .NET Team. (2020, March 11). Visual Basic support planned for .NET 5.0. Retrieved June 23, 2020.
url: https://devblogs.microsoft.com/vbteam/visual-basic-support-planned-for-net-5-0/
source_name: Default VBS macros Blocking 
description: Kellie Eickmeyer. (2022, February 7). Helping users stay safe: Blocking internet macros by default in Office. Retrieved February 7, 2022.
url: https://techcommunity.microsoft.com/t5/microsoft-365-blog/helping-users-stay-safe-blocking-internet-macros-by-default-in/ba-p/3071805
source_name: Microsoft VBScript
description: Microsoft. (2011, April 19). What Is VBScript?. Retrieved March 28, 2020.
url: https://docs.microsoft.com/previous-versions//1kw29xwf(v=vs.85)
source_name: Microsoft VBA
description: Microsoft. (2019, June 11). Office VBA Reference. Retrieved June 23, 2020.
url: https://docs.microsoft.com/office/vba/api/overview/
source_name: VB Microsoft
description: Microsoft. (n.d.). Visual Basic documentation. Retrieved June 23, 2020.
url: https://docs.microsoft.com/dotnet/visual-basic/
source_name: Wikipedia VBA
description: Wikipedia. (n.d.). Visual Basic for Applications. Retrieved August 13, 2020.
url: https://en.wikipedia.org/wiki/Visual_Basic_for_Applications
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:29.678Z
name: Visual Basic
description: Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows technologies such as [Component Object Model](https://attack.mitre.org/techniques/T1559/001) and the [Native API](https://attack.mitre.org/techniques/T1106) through the Windows API. Although tagged as legacy with no planned future evolutions, VB is integrated and supported in the .NET Framework and cross-platform .NET Core.(Citation: VB .NET Mar 2020)(Citation: VB Microsoft)

Derivative languages based on VB have also been created, such as Visual Basic for Applications (VBA) and VBScript. VBA is an event-driven programming language built into Microsoft Office, as well as several third-party applications.(Citation: Microsoft VBA)(Citation: Wikipedia VBA) VBA enables documents to contain macros used to automate the execution of tasks and other functionality on the host. VBScript is a default scripting language on Windows hosts and can also be used in place of [JavaScript](https://attack.mitre.org/techniques/T1059/007) on HTML Application (HTA) webpages served to Internet Explorer (though most modern browsers do not come with VBScript support).(Citation: Microsoft VBScript)

Adversaries may use VB payloads to execute malicious commands. Common malicious usage includes automating execution of behaviors with VBScript or embedding VBA content into [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001) payloads (which may also involve [Mark-of-the-Web Bypass](https://attack.mitre.org/techniques/T1553/005) to enable execution).(Citation: Default VBS macros Blocking )
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: execution
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Linux
macOS
Windows
x_mitre_version: 1.5
x_mitre_remote_support: no