sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
Peppy has the ability to execute shell commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
PingPull can use `cmd.exe` to run various commands as a reverse shell.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Pisloader uses cmd.exe to set the Registry Run key value. It also has a command to spawn a command shell.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
PlugX allows actors to spawn a reverse shell on a victim.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
PoetRAT has called cmd through a Word document macro.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
PoisonIvy creates a backdoor through which remote attackers can open a command-line interface.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Pony has used batch scripts to delete itself after execution.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
PowerDuke runs `cmd.exe /c` and sends the output to its C2.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Proxysvc executes a binary on the system and logs the results into a temp file by using: `cmd.exe /c "<file_path> > %temp%\PM* .tmp 2>&1"`.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Pteranodon can use `cmd.exe` for execution on victim systems.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
PyDCrypt has used `cmd.exe` for execution.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
QUADAGENT uses cmd.exe to execute scripts and commands on the victim’s machine.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
QakBot can use cmd.exe to launch itself and to execute multiple C2 commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
QuasarRAT can launch a remote shell to execute commands on the victim’s machine.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
RATANKBA uses cmd.exe to execute commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
RCSession can use `cmd.exe` for execution on compromised hosts.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
RDAT has executed commands using `cmd.exe /c`.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
REvil can use the Windows command line to delete volume shadow copies and disable recovery.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
RGDoor uses cmd.exe to execute commands on the victim’s machine.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
RTM uses the command line and rundll32.exe to execute.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Ragnar Locker has used cmd.exe and batch scripts to execute commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
RainyDay can use the Windows Command Shell for execution.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
RedLeaves can receive and execute commands with cmd.exe. It can also provide a reverse shell.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Remcos can launch a remote command line to execute commands on the victim’s machine.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Remexi silently executes received commands with cmd.exe.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Revenge RAT uses cmd.exe to execute commands and run scripts on the victim's machine.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Rising Sun has executed commands using `cmd.exe /c “<command> > <%temp%>\AM<random>. tmp” 2>&1`.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
RobbinHood uses cmd.exe on the victim's computer.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
RogueRobin uses Windows Script Components.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
RunningRAT uses a batch file to kill a security program task and then attempts to remove itself.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Ryuk has used `cmd.exe` to create a Registry entry to establish persistence.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
S-Type has provided the ability to execute shell commands on a compromised host.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
SDBbot has the ability to use the command shell to execute commands on a compromised host.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
SEASHARPEE can execute commands on victims.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
SILENTTRINITY can use `cmd.exe` to enable lateral movement using DCOM.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
SLOTHFULMEDIA can open a command line to execute commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
SNUGRIDE is capable of executing commands and spawning a reverse shell.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
SQLRat has used SQL to execute JavaScript and VB scripts on the host system.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
STARWHALE has the ability to execute commands via `cmd.exe`.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
SUGARUSH has used `cmd` for execution on an infected host.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
SYSCON has the ability to execute commands through cmd on a compromised host.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Saint Bot has used `cmd.exe` and `.bat` scripts for execution.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Sakula calls cmd.exe to run various DLL files via rundll32 and also to perform file cleanup. Sakula also has the capability to invoke a reverse shell.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
SamSam uses custom batch scripts to execute some of its components.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Samurai can use a remote command module for execution via the Windows command line.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Sardonic has the ability to run `cmd.exe` or other interactive processes on a compromised computer.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
SeaDuke is capable of executing commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Seasalt uses cmd.exe to create a reverse shell on the infected endpoint.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
ServHelper can execute shell commands against cmd.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Seth-Locker can execute commands via the command line shell.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Shark has the ability to use `CMD` to execute commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
SharpDisco can use `cmd.exe` to execute plugins and to send command output to  specified SMB shares.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
SharpStage can execute arbitrary commands with the command line.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
ShimRat can be issued a command shell function from the C2.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
SideTwist can execute shell commands on a compromised host.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Siloscape can run cmd through an IRC channel.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Small Sieve can use `cmd.exe` to execute commands on a victim's system.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Spark can use cmd.exe to run commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Squirrelwaffle has used `cmd.exe` for execution.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
StreamEx has the ability to remotely execute commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
StrifeWater can execute shell commands using `cmd.exe`.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
TAINTEDSCRIBE can enable Windows CLI access and execute files.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
TDTESS provides a reverse shell on the victim.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
TEXTMATE executes cmd.exe to provide a reverse shell to adversaries.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
TSCookie has the ability to execute shell commands on the infected host.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
TURNEDUP is capable of creating a reverse shell.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
TYPEFRAME can uninstall malware components using a batch script. TYPEFRAME can execute commands using a shell.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Taidoor can copy cmd.exe into the system temp folder.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Tarrask may abuse the Windows schtasks command-line tool to create "hidden" scheduled tasks.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
TinyTurla has been installed using a .bat file.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
TinyZBot supports execution from the command-line.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
TrickBot has used macros in Excel documents to download and deploy the malware on the user’s machine.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Trojan.Karagany can perform reconnaissance commands on a victim machine via a cmd.exe process.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Turian can create a remote shell and execute commands using cmd.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
UBoatRAT can start a command shell.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
UPPERCUT uses cmd.exe to execute commands on the victim’s machine.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
USBferry can execute various Windows commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Umbreon provides access using both standard facilities like SSH and additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Uroburos has the ability to use the command line for execution on the targeted system.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Volgmer can execute commands on the victim's machine.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
WEBC2 can open an interactive command shell.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
WarzoneRAT can use `cmd.exe` to execute malicious code.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
WastedLocker has used cmd to execute commands on the system.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
WellMess can execute command line scripts received from C2.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
WhisperGate can use `cmd.exe` to execute commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Wiarp creates a backdoor through which remote attackers can open a command line interface.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Woody RAT can execute commands using `cmd.exe`.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
XTunnel has been used to execute remote commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
ZLib has the ability to execute shell commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Zebrocy uses cmd.exe to execute commands on the system.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Zeus Panda can launch an interface where it can execute several commands on the victim’s PC.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
ZxShell can launch a reverse command shell.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
adbupd can run a copy of cmd.exe.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
ccf32 has used `cmd.exe` for archiving data and deleting files.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
cmd is used to execute programs and other actions at the command-line interface.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
hcdLoader provides command-line access to the compromised system.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
httpclient opens cmd.exe on the victim.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
jRAT has command line access.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
njRAT can launch a command shell interface for executing commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
xCaon has a command to start an interactive shell.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
zwShell can launch command-line shells.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
APT41 executed `file /bin/pwd` in activity exploiting CVE-2019-19781 against Citrix devices.
Technique: T1059.004 Command and Scripting Interpreter: Unix Shell, Tactic: TA0002 Execution
Rocke used shell scripts to run commands which would obtain persistence and execute the cryptocurrency mining malware.
Technique: T1059.004 Command and Scripting Interpreter: Unix Shell, Tactic: TA0002 Execution
TeamTNT has used shell scripts for execution.
Technique: T1059.004 Command and Scripting Interpreter: Unix Shell, Tactic: TA0002 Execution
Anchor can execute payloads via shell scripting.
Technique: T1059.004 Command and Scripting Interpreter: Unix Shell, Tactic: TA0002 Execution
AppleJeus has used shell scripts to execute commands after installation and set persistence mechanisms.
Technique: T1059.004 Command and Scripting Interpreter: Unix Shell, Tactic: TA0002 Execution
Bundlore has leveraged /bin/sh and /bin/bash to execute commands on the victim machine.
Technique: T1059.004 Command and Scripting Interpreter: Unix Shell, Tactic: TA0002 Execution
COATHANGER provides a BusyBox reverse shell for command and control.
Technique: T1059.004 Command and Scripting Interpreter: Unix Shell, Tactic: TA0002 Execution
CallMe has the capability to create a reverse shell on victims.
Technique: T1059.004 Command and Scripting Interpreter: Unix Shell, Tactic: TA0002 Execution
Chaos provides a reverse shell connection on 8338/TCP, encrypted via AES.
Technique: T1059.004 Command and Scripting Interpreter: Unix Shell, Tactic: TA0002 Execution
CoinTicker executes a bash script to establish a reverse shell.
Technique: T1059.004 Command and Scripting Interpreter: Unix Shell, Tactic: TA0002 Execution
CookieMiner has used a Unix shell script to run a series of commands targeting macOS.
Technique: T1059.004 Command and Scripting Interpreter: Unix Shell, Tactic: TA0002 Execution
Derusbi is capable of creating a remote Bash shell and executing commands.
Technique: T1059.004 Command and Scripting Interpreter: Unix Shell, Tactic: TA0002 Execution
Doki has executed shell scripts with /bin/sh.
Technique: T1059.004 Command and Scripting Interpreter: Unix Shell, Tactic: TA0002 Execution
Drovorub can execute arbitrary commands as root on a compromised system.
Technique: T1059.004 Command and Scripting Interpreter: Unix Shell, Tactic: TA0002 Execution
Exaramel for Linux has a command to execute a shell command on the system.
Technique: T1059.004 Command and Scripting Interpreter: Unix Shell, Tactic: TA0002 Execution
Fysbis has the ability to create and execute commands in a remote shell for CLI.
Technique: T1059.004 Command and Scripting Interpreter: Unix Shell, Tactic: TA0002 Execution
Green Lambert can use shell scripts for execution, such as `/bin/sh -c`.
Technique: T1059.004 Command and Scripting Interpreter: Unix Shell, Tactic: TA0002 Execution
Hildegard has used shell scripts for execution.
Technique: T1059.004 Command and Scripting Interpreter: Unix Shell, Tactic: TA0002 Execution
Kazuar uses /bin/bash to execute commands on the victim’s machine.
Technique: T1059.004 Command and Scripting Interpreter: Unix Shell, Tactic: TA0002 Execution
Kinsing has used Unix shell scripts to execute commands in the victim environment.
Technique: T1059.004 Command and Scripting Interpreter: Unix Shell, Tactic: TA0002 Execution
Kobalos can spawn a new pseudo-terminal and execute arbitrary commands at the command prompt.
Technique: T1059.004 Command and Scripting Interpreter: Unix Shell, Tactic: TA0002 Execution
LoudMiner used shell scripts to launch various services and to start/stop the QEMU virtualization.
Technique: T1059.004 Command and Scripting Interpreter: Unix Shell, Tactic: TA0002 Execution
MacMa can execute supplied shell commands and uses bash scripts to perform additional actions.
Technique: T1059.004 Command and Scripting Interpreter: Unix Shell, Tactic: TA0002 Execution
NETWIRE has the ability to use `/bin/bash` and `/bin/sh` to execute commands.
Technique: T1059.004 Command and Scripting Interpreter: Unix Shell, Tactic: TA0002 Execution
NKAbuse is initially installed and executed through an initial shell script.
Technique: T1059.004 Command and Scripting Interpreter: Unix Shell, Tactic: TA0002 Execution
OSX/Shlayer can use bash scripts to check the macOS version, download payloads, and extract bytes from files. OSX/Shlayer uses the command `sh -c tail -c +1381...` to extract bytes at an offset from a specified file. OSX/Shlayer uses the `curl -fsL "$url" >$tmp_path` command to download malicious payloads into a temporary directory.
Technique: T1059.004 Command and Scripting Interpreter: Unix Shell, Tactic: TA0002 Execution
OSX_OCEANLOTUS.D uses a shell script as the main executable inside an app bundle and drops an embedded base64-encoded payload to the `/tmp` folder.
Technique: T1059.004 Command and Scripting Interpreter: Unix Shell, Tactic: TA0002 Execution
PACEMAKER can use a simple bash script for execution.
Technique: T1059.004 Command and Scripting Interpreter: Unix Shell, Tactic: TA0002 Execution
PITSTOP has the ability to receive shell commands over a Unix domain socket.
Technique: T1059.004 Command and Scripting Interpreter: Unix Shell, Tactic: TA0002 Execution
PULSECHECK can use Unix shell script for command execution.
Technique: T1059.004 Command and Scripting Interpreter: Unix Shell, Tactic: TA0002 Execution
Penquin can execute remote commands using bash scripts.
Technique: T1059.004 Command and Scripting Interpreter: Unix Shell, Tactic: TA0002 Execution
Proton uses macOS' .command file type to script actions.
Technique: T1059.004 Command and Scripting Interpreter: Unix Shell, Tactic: TA0002 Execution
Skidmap has used `pm.sh` to download and install its main payload.
Technique: T1059.004 Command and Scripting Interpreter: Unix Shell, Tactic: TA0002 Execution
Turian has the ability to use `/bin/sh` to execute commands.
Technique: T1059.004 Command and Scripting Interpreter: Unix Shell, Tactic: TA0002 Execution
WindTail can use the `open` command to execute an application.
Technique: T1059.004 Command and Scripting Interpreter: Unix Shell, Tactic: TA0002 Execution
XCSSET uses a shell script to execute Mach-o files and `osacompile` commands such as, `osacompile -x -o xcode.app main.applescript`.
Technique: T1059.004 Command and Scripting Interpreter: Unix Shell, Tactic: TA0002 Execution
ZIPLINE can use `/bin/sh` to create a reverse shell and execute commands.
Technique: T1059.004 Command and Scripting Interpreter: Unix Shell, Tactic: TA0002 Execution
During the 2015 Ukraine Electric Power Attack, Sandworm Team installed a VBA script called `vba_macro.exe`. This macro dropped `FONTCACHE.DAT`, the primary BlackEnergy implant; `rundll32.exe`, for executing the malware; `NTUSER.log`, an empty file; and desktop.ini, the default file used to determine folder displays on Windows machines.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
During the 2016 Ukraine Electric Power Attack, Sandworm Team created VBScripts to run on an SSH server.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
For C0011, Transparent Tribe used malicious VBA macros within a lure document as part of the Crimson malware installation process onto a compromised host.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
During C0015, the threat actors used a malicious HTA file that contained a mix of HTML and JavaScript/VBScript code.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
During Frankenstein, the threat actors used Word documents that prompted the victim to enable macros and run a Visual Basic script.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
During FunnyDream, the threat actors used a Visual Basic script to run remote commands.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
During Operation CuckooBees, the threat actors executed an encoded VBScript file using `wscript` and wrote the decoded output to a text file.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
During Operation Dream Job, Lazarus Group executed a VBA written malicious macro after victims download malicious DOTM files; Lazarus Group also used Visual Basic macro code to extract a double Base64 encoded DLL implant.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
During Operation Dust Storm, the threat actors used Visual Basic scripts.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
For Operation Honeybee, the threat actors used a Visual Basic script embedded within a Word document to download an implant.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
During Operation Sharpshooter, the threat actors used a VBA macro to execute a simple downloader that installed Rising Sun.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
During Operation Wocao, threat actors used VBScript to conduct reconnaissance on targeted systems.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
For the SolarWinds Compromise, APT29 wrote malware such as Sibot in Visual Basic.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
APT-C-36 has embedded a VBScript within a malicious Word document which is executed upon the document opening.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
APT32 has used macros, COM scriptlets, and VBS scripts.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
APT33 has used VBScript to initiate the delivery of payloads.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
APT37 executes shellcode and a VBA script to decode Base64 strings.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
APT38 has used VBScript to execute commands and other operational tasks.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
APT39 has utilized malicious VBS scripts in malware.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
BRONZE BUTLER has used VBS and VBE scripts for execution.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Cobalt Group has sent Word OLE compound documents with malicious obfuscated VBA macros that will run upon user execution.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Confucius has used VBScript to execute malicious code.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Earth Lusca used VBA scripts.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
FIN13 has used VBS scripts for code execution on comrpomised machines.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
FIN4 has used VBA macros to display a dialog box and collect victim credentials.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
FIN7 used VBS scripts to help perform tasks on the victim's machine.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Gamaredon Group has embedded malicious macros in document templates, which executed VBScript. Gamaredon Group has also delivered Microsoft Outlook VBA projects with embedded macros.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Gorgon Group has used macros in Spearphishing Attachments as well as executed VBScripts on victim machines.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
HEXANE has used a VisualBasic script named `MicrosoftUpdator.vbs` for execution of a PowerShell keylogger.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Higaisa has used VBScript code on the victim's machine.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Inception has used VBScript to execute malicious commands and payloads.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Kimsuky has used Visual Basic to download malicious payloads. Kimsuky has also used malicious VBA macros within maldocs disguised as forms that trigger when a victim types any content into the lure.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Lazarus Group has used VBA and embedded macros in Word documents to execute malicious code.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
LazyScripter has used VBScript to execute malicious code.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Leviathan has used VBScript.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Machete has embedded malicious macros within spearphishing attachments to download additional files.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Magic Hound malware has used VBS scripts for execution.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Malteiro has utilized a dropper containing malicious VBS scripts.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Molerats used various implants, including those built with VBScript, on target machines.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
MuddyWater has used VBScript files to execute its POWERSTATS payload, as well as macros.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Mustang Panda has embedded VBScript components in LNK files to download additional files and automate collection.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
OilRig has used VBScript macros for execution on compromised hosts.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Patchwork used Visual Basic Scripts (VBS) on victim machines.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Rancor has used VBS scripts as well as embedded macros for execution.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Sandworm Team has created VBScripts to run an SSH server.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
SideCopy has sent Microsoft Office Publisher documents to victims that have embedded malicious macros that execute an hta file via calling `mshta.exe`.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Sidewinder has used VBScript to drop and execute malware loaders.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Silence has used VBS scripts.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
TA2541 has used VBS files to execute or establish persistence for additional payloads, often using file names consistent with email themes or mimicking system functionality.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
TA459 has a VBScript for execution.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
TA505 has used VBS for code execution.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Transparent Tribe has crafted VBS-based malicious documents.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Turla has used VBS scripts throughout its operations.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
WIRTE has used VBScript  in its operations.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Windshift has used Visual Basic 6 (VB6) payloads.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Astaroth has used malicious VBS e-mail attachments for execution.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
BackConfig has used VBS to install its downloader component and malicious documents with VBA macro code.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Bandook has used malicious VBA code against the target system.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Bisonal's dropper creates VBS scripts on the victim’s machine.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Bumblebee can create a Visual Basic script to enable persistence.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Chaes has used VBscript to execute malicious code.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Cobalt Strike can use VBA to perform execution.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Comnie executes VBS scripts.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
DanBot can use a VBA macro embedded in an Excel file to drop the payload.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
DarkGate initial infection mechanisms include masquerading as pirated media that launches malicious VBScript on the victim.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Donut can generate shellcode outputs that execute via VBScript.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Emotet has sent Microsoft Word documents with embedded macros that will invoke scripts to download additional payloads.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Exaramel for Windows has a command to execute VBS scripts on the victim’s machine.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Ferocious has the ability to use Visual Basic scripts for execution.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Flagpro can execute malicious VBA macros embedded in .xlsm files.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Goopy has the ability to use a Microsoft Outlook backdoor macro to communicate with its C2.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Grandoreiro can use VBScript to execute malicious code.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
One version of Helminth consists of VBScript scripts.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
IcedID has used obfuscated VBA string expressions.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
JCry has used VBS scripts.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
JSS Loader can download and execute VBScript files.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Javali has used embedded VBScript to download malicious payloads from C2.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
KOCTOPUS has used VBScript to call wscript to execute a PowerShell command.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Kerrdown can use a VBS base64 decoder function published by Motobit.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
KeyBoy uses VBS scripts for installing files and performing execution.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Koadic performs most of its operations using Windows Script Host (VBScript) and runs arbitrary shellcode .
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Lokibot has used VBS scripts and XLS macros for execution.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
LookBack has used VBA macros in Microsoft Word attachments to drop additional files to the host.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Melcoz can use VBS scripts to execute malicious DLLs.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Metamorfo has used VBS code on victims’ systems.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Mispadu’s dropper uses VBS files to install payloads and perform execution.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
NETWIRE has been executed through use of VBScripts.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
NanHaiShu executes additional VBScript code on the victim's machine.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
NanoCore uses VBS files.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
OSX_OCEANLOTUS.D uses Word macros for execution.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
OopsIE creates and uses a VBScript as part of its persistent execution.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
POWERSTATS can use VBScript (VBE) code for execution.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
PoetRAT has used Word documents with VBScripts to execute malicious activities.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
PowerShower has the ability to save and execute VBScript.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Pteranodon can use a malicious VBS file for execution.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
QUADAGENT uses VBScripts.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
QakBot can use VBS to download and execute malicious files.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
REvil has used obfuscated VBA macros for execution.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
ROKRAT has used Visual Basic for execution.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Ramsay has included embedded Visual Basic scripts in malicious documents.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Remexi uses AutoIt and VBS scripts throughout its execution process.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
STARWHALE can use the VBScript function `GetRef` as part of its persistence mechanism.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
SUNBURST used VBScripts to initiate the execution of payloads.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
SVCReady has used VBA macros to execute shellcode.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Saint Bot has used `.vbs` scripts for execution.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Sibot executes commands using VBScript.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Smoke Loader adds a Visual Basic script in the Startup folder to deploy the payload.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Snip3 can use visual basic scripts for first-stage execution.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Squirrelwaffle has used malicious VBA macros in Microsoft Word documents and Excel spreadsheets that execute an `AutoOpen` subroutine.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
StoneDrill has several VBS scripts used throughout the malware's lifecycle.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
TYPEFRAME has used a malicious Word document for delivery with VBA macros for execution.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Ursnif droppers have used VBA macros to download and execute the malware's full executable payload.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
VBShower has the ability to execute VBScript files.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
WhisperGate can use a Visual Basic script to exclude the `C:\` drive from Windows Defender.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
Xbash can execute malicious VBScript payloads on the victim’s machine.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
jRAT has been distributed as HTA files with VBScript.
Technique: T1059.005 Command and Scripting Interpreter: Visual Basic, Tactic: TA0002 Execution
During Cutting Edge, threat actors used a Python reverse shell and the PySoxy SOCKS5 proxy tool.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
During Operation Wocao, threat actors' backdoors were written in Python and compiled with py2exe.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
APT29 has developed malware variants written in Python.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
APT37 has used Python scripts to execute payloads.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
APT39 has used a command line utility and a network scanner written in python.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
BRONZE BUTLER has made use of Python-based remote access tools.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
Cinnamon Tempest has used a customized version of the Impacket wmiexec.py module to create renamed output files.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
Dragonfly has used various types of scripting to perform operations, including Python scripts. The group was observed installing Python 2.7 on a victim.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
Earth Lusca used Python scripts for port scanning or building reverse shells.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
Kimsuky has used a macOS Python implant to gather data as well as MailFetcher.py code to automatically collect email data.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
Machete used multiple compiled Python scripts on the victim’s system. Machete's main backdoor Machete is also written in Python.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
MuddyWater has developed tools in Python including Out1.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
Rocke has used Python-based malware to install and spread their coinminer.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
Tonto Team has used Python-based tools for execution.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
Turla has used IronPython scripts as part of the IronNetInjector toolchain to drop payloads.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
ZIRCONIUM has used Python-based implants to interact with compromised hosts.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
Bandook can support commands to execute Python-based payloads.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
Bundlore has used Python scripts to execute payloads.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
Chaes has used Python scripts for execution and the installation of additional files.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
Cobalt Strike can use Python to perform execution.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
CoinTicker executes a Python script to download its second stage.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
CookieMiner has used python scripts on the user’s system, as well as the Python variant of the Empire agent, EmPyre.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
Donut can generate shellcode outputs that execute via Python.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
DropBook is a Python-based backdoor compiled with PyInstaller.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
Ebury has used Python to implement its DGA.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
FRAMESTING is a Python web shell that can embed in the Ivanti Connect Secure CAV Python package.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
IronNetInjector can use IronPython scripts to load payloads with the help of a .NET injector.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
KeyBoy uses Python scripts for installing files and performing execution.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution
Keydnap uses Python for scripting to execute additional commands.
Technique: T1059.006 Command and Scripting Interpreter: Python, Tactic: TA0002 Execution