type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--9f387817-df83-432a-b56b-a8fb7f71eedd
created: 2021-10-20T15:05:19.272Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0029
external_id: DC0029
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Script Execution
description: The execution of a text file that contains code via the interpreter.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: Script
channel: None
name: m365:office
channel: VBA auto_open, auto_close, or document_open events
name: macos:unifiedlog
channel: log stream --predicate 'eventMessage contains "python"'
name: linux:syslog
channel: /var/log/syslog
name: WinEventLog:System
channel: EventCode=1502, 1503
name: macos:unifiedlog
channel: log stream --predicate 'eventMessage contains "wscript" OR "vbs"'
name: macos:unifiedlog
channel: osascript or AppleScript invocation modifying UI
name: networkdevice:runtime
channel: runtime
name: macos:unifiedlog
channel: log
name: esxi:vmkernel
channel: boot
name: macos:unifiedlog
channel: AppleScript creating login item via 'System Events' dictionary
name: WinEventLog:PowerShell
channel: EventCode=4103, 4104, 4105, 4106
name: WinEventLog:Application
channel: Stored procedure creation, modification, or xp_cmdshell invocation via SQL logs or SQL Server auditing
name: ApplicationLogs:SQL
channel: Stored procedure creation or modification with shell invocation (e.g., system(), exec())
name: macos:unifiedlog
channel: subsystem=launchservices
name: WinEventLog:PowerShell
channel: Set-ADUser or Set-ADAuthenticationPolicy with MFA attributes disabled
name: EDR:scriptblock
channel: Process Tree + Script Block Logging
name: linux:syslog
channel: boot logs
name: m365:defender
channel: ScriptBlockLogging + AMSI
name: macos:unifiedlog
channel: log stream with predicate 'eventMessage CONTAINS "osascript"'
name: etw:Microsoft-Antimalware-Scan-Interface
channel: Amsi/Script content + API verdicts during in-memory staging
name: esxi:shell
channel: None
name: WinEventLog:System
channel: EventCode=4016, 5312
name: auditd:PROCTITLE
channel: scripting loop invoking sleep/ping
name: WinEventLog:PowerShell
channel: Scripts with references to XML parsing, AES decryption, or gpprefdecrypt logic
name: macos:syslog
channel: system.log, asl.log
name: macos:osquery
channel: exec: Unexpected execution of osascript or AppleScript targeting sensitive apps
name: macos:unifiedlog
channel: subsystem=com.apple.Security or com.apple.applescript
name: azure:activity
channel: Microsoft.Compute/virtualMachines/runCommand/action: Abnormal initiation of Azure RunCommand jobs or PowerShell/Bash payloads
name: EDR:AMSI
channel: Malicious inline C#/script blobs embedded in MSBuild projects if intercepted by AMSI-aware loaders (rare but possible via chained LOLBins)
name: macos:unifiedlog
channel: osascript, AppleScript, or Python execution triggered immediately after HID connection
name: m365:unified
channel: Scripted Activity