type: attack-pattern
spec_version: 2.1
id: attack-pattern--7fd87010-3a00-4da3-b905-410525e8ec44
created: 2017-05-31T21:30:51.733Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1064
external_id: T1064
source_name: Metasploit_Ref
description: Metasploit. (n.d.). Retrieved December 4, 2014.
url: http://www.metasploit.com
source_name: Veil_Ref
description: Veil Framework. (n.d.). Retrieved December 4, 2014.
url: https://www.veil-framework.com/framework/
source_name: Powersploit
description: PowerSploit. (n.d.). Retrieved December 4, 2014.
url: https://github.com/mattifestation/PowerSploit
source_name: Alperovitch 2014
description: Alperovitch, D. (2014, July 7). Deep in Thought: Chinese Targeting of National Security Think Tanks. Retrieved November 12, 2014.
url: https://blog.crowdstrike.com/deep-thought-chinese-targeting-national-security-think-tanks/
source_name: Uperesia Malicious Office Documents
description: Felix. (2016, September). Analyzing Malicious Office Documents. Retrieved April 11, 2018.
url: https://www.uperesia.com/analyzing-malicious-office-documents
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:01.561Z
name: Scripting
description: **This technique has been deprecated. Please use [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) where appropriate.**

Adversaries may use scripts to aid in operations and perform multiple actions that would otherwise be manual. Scripting is useful for speeding up operational tasks and reducing the time required to gain access to critical resources. Some scripting languages may be used to bypass process monitoring mechanisms by directly interacting with the operating system at an API level instead of calling other programs. Common scripting languages for Windows include VBScript and [PowerShell](https://attack.mitre.org/techniques/T1086) but could also be in the form of command-line batch scripts.

Scripts can be embedded inside Office documents as macros that can be set to execute when files used in [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193) and other types of spearphishing are opened. Malicious embedded macros are an alternative means of execution than software exploitation through [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203), where adversaries will rely on macros being allowed or that the user will accept to activate them.

Many popular offensive frameworks exist which use forms of scripting for security testers and adversaries alike. Metasploit (Citation: Metasploit_Ref), Veil (Citation: Veil_Ref), and PowerSploit (Citation: Powersploit) are three examples that are popular among penetration testers for exploit and post-compromise operations and include many features for evading defenses. Some adversaries are known to use PowerShell. (Citation: Alperovitch 2014)
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: defense-evasion
kill_chain_name: mitre-attack
phase_name: execution
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Linux
macOS
Windows
x_mitre_version: 1.1