Skip to content

T1059.007 JavaScript

Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.1

JScript is the Microsoft implementation of the same scripting standard. JScript is interpreted via the Windows Script engine and thus integrated with many components of Windows such as the Component Object Model and Internet Explorer HTML Application (HTA) pages.234

JavaScript for Automation (JXA) is a macOS scripting language based on JavaScript, included as part of Apple’s Open Scripting Architecture (OSA), that was introduced in OSX 10.10. Apple’s OSA provides scripting capabilities to control applications, interface with the operating system, and bridge access into the rest of Apple’s internal APIs. As of OSX 10.10, OSA only supports two languages, JXA and AppleScript. Scripts can be executed via the command line utility osascript, they can be compiled into applications or script files via osacompile, and they can be compiled and executed in memory of other programs by leveraging the OSAKit Framework.56789

Adversaries may abuse various implementations of JavaScript to execute various behaviors. Common uses include hosting malicious scripts on websites as part of a Drive-by Compromise or downloading and executing these script files as secondary payloads. Since these payloads are text-based, it is also very common for adversaries to obfuscate their content as part of Obfuscated Files or Information.

Item Value
ID T1059.007
Sub-techniques T1059.001, T1059.002, T1059.003, T1059.004, T1059.005, T1059.006, T1059.007, T1059.008
Tactics TA0002
Platforms Linux, Windows, macOS
Permissions required Administrator, SYSTEM, User
Version 2.1
Created 23 June 2020
Last Modified 16 August 2021

Procedure Examples

ID Name Description
S0622 AppleSeed AppleSeed has the ability to use JavaScript to execute PowerShell.12
G0050 APT32 APT32 has used JavaScript for drive-by downloads and C2 communications.4445
S0373 Astaroth Astaroth uses JavaScript to perform its core functionalities. 2223
S0640 Avaddon Avaddon has been executed through a malicious JScript downloader.2425
S0482 Bundlore Bundlore can execute JavaScript by injecting it into the victim’s browser.19
S0631 Chaes Chaes has used JavaScript and Node.Js information stealer script that exfiltrates data using the node process.32
G0080 Cobalt Group Cobalt Group has executed JavaScript scriptlets on the victim’s machine.525354555657
S0154 Cobalt Strike The Cobalt Strike System Profiler can use JavaScript to perform reconnaissance actions.30
S0673 DarkWatchman DarkWatchman uses JavaScript to perform its core functionalities.18
S0695 Donut Donut can generate shellcode outputs that execute via JavaScript or JScript.11
S0634 EnvyScout EnvyScout can write files to disk with JavaScript using a modified version of the open-source tool FileSaver.28
G0120 Evilnum Evilnum has used malicious JavaScript files on the victim’s machine.60
G0037 FIN6 FIN6 has used malicious JavaScript to steal payment card data from e-commerce sites.38
G0046 FIN7 FIN7 used JavaScript scripts to help perform tasks on the victim’s machine.394039
S0417 GRIFFON GRIFFON is written in and executed as JavaScript.31
G0126 Higaisa Higaisa used JavaScript to execute additional files.343536
G0119 Indrik Spider Indrik Spider has used malicious JavaScript files for several components of their attack.46
S0260 InvisiMole InvisiMole can use a JavaScript file as part of its execution chain.20
S0283 jRAT jRAT has been distributed as HTA files with JScript.27
S0648 JSS Loader JSS Loader can download and execute JavaScript files.17
G0094 Kimsuky Kimsuky has used JScript for logging and downloading additional tools.4748
S0356 KONNI KONNI has executed malicious JavaScript code.26
G0140 LazyScripter LazyScripter has used JavaScript in its attacks.61
G0077 Leafminer Leafminer infected victims using JavaScript code.59
S0455 Metamorfo Metamorfo includes payloads written in JavaScript.14
G0021 Molerats Molerats used various implants, including those built with JS, on target machines.37
G0069 MuddyWater MuddyWater has used JavaScript files to execute its POWERSTATS payload.1651
S0228 NanHaiShu NanHaiShu executes additional Jscript code on the victim’s machine.29
S0223 POWERSTATS POWERSTATS can use JavaScript code for execution.16
S0650 QakBot The QakBot web inject module can inject Java Script into web banking pages visited by the victim.33
G0121 Sidewinder Sidewinder has used JavaScript to drop and execute malware loaders.4243
G0091 Silence Silence has used JS scripts.41
S0646 SpicyOmelette SpicyOmelette has the ability to execute arbitrary JavaScript code on a compromised host.21
G0092 TA505 TA505 has used JavaScript for code execution.4950
G0010 Turla Turla has used various JavaScript-based backdoors.58
S0476 Valak Valak can execute JavaScript containing configuration data for establishing persistence.15
S0341 Xbash Xbash can execute malicious JavaScript payloads on the victim’s machine.13

Mitigations

ID Mitigation Description
M1040 Behavior Prevention on Endpoint On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent JavaScript scripts from executing potentially malicious downloaded content 10.
M1042 Disable or Remove Feature or Program Turn off or restrict access to unneeded scripting components.
M1038 Execution Prevention Denylist scripting where appropriate.
M1021 Restrict Web-Based Content Script blocking extensions can help prevent the execution of JavaScript and HTA files that may commonly be used during the exploitation process. For malicious code served up through ads, adblockers can help prevent that code from executing in the first place.

Detection

ID Data Source Data Component
DS0017 Command Command Execution
DS0011 Module Module Load
DS0009 Process Process Creation
DS0012 Script Script Execution

References

  1. OpenJS Foundation. (n.d.). Node.js. Retrieved June 23, 2020. ↩

  2. Microsoft. (2018, May 31). Translating to JScript. Retrieved June 23, 2020. ↩

  3. Microsoft. (2007, August 15). The World of JScript, JavaScript, ECMAScript …. Retrieved June 23, 2020. ↩

  4. Microsoft. (2017, January 18). Windows Script Interfaces. Retrieved June 23, 2020. ↩

  5. Apple. (2016, June 13). About Mac Scripting. Retrieved April 14, 2021. ↩

  6. Pitt, L. (2020, August 6). Persistent JXA. Retrieved April 14, 2021. ↩

  7. Phil Stokes. (2019, December 5). macOS Red Team: Calling Apple APIs Without Building Binaries. Retrieved July 17, 2020. ↩

  8. Tony Lambert. (2021, February 18). Clipping Silver Sparrow’s wings: Outing macOS malware before it takes flight. Retrieved April 20, 2021. ↩

  9. Dominic Chell. (2021, January 1). macOS Post-Exploitation Shenanigans with VSCode Extensions. Retrieved April 20, 2021. ↩

  10. Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021. ↩

  11. TheWover. (2019, May 9). donut. Retrieved March 25, 2022. ↩

  12. Jazi, H. (2021, June 1). Kimsuky APT continues to target South Korean government using AppleSeed backdoor. Retrieved June 10, 2021. ↩

  13. Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018. ↩

  14. Erlich, C. (2020, April 3). The Avast Abuser: Metamorfo Banking Malware Hides By Abusing Avast Executable. Retrieved May 26, 2020. ↩

  15. Salem, E. et al. (2020, May 28). VALAK: MORE THAN MEETS THE EYE . Retrieved June 19, 2020. ↩

  16. ClearSky Cyber Security. (2018, November). MuddyWater Operations in Lebanon and Oman: Using an Israeli compromised domain for a two-stage campaign. Retrieved November 29, 2018. ↩↩

  17. Loui, E. and Reynolds, J. (2021, August 30). CARBON SPIDER Embraces Big Game Hunting, Part 1. Retrieved September 20, 2021. ↩

  18. Smith, S., Stafford, M. (2021, December 14). DarkWatchman: A new evolution in fileless techniques. Retrieved January 10, 2022. ↩

  19. Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020. ↩

  20. Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020. ↩

  21. CTU. (2018, September 27). Cybercriminals Increasingly Trying to Ensnare the Big Financial Fish. Retrieved September 20, 2021. ↩

  22. Doaty, J., Garrett, P.. (2018, September 10). We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan. Retrieved April 17, 2019. ↩

  23. GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020. ↩

  24. Security Lab. (2020, June 5). Avaddon: From seeking affiliates to in-the-wild in 2 days. Retrieved August 19, 2021. ↩

  25. Gahlot, A. (n.d.). Threat Hunting for Avaddon Ransomware. Retrieved August 19, 2021. ↩

  26. Threat Intelligence Team. (2021, August 23). New variant of Konni malware used in campaign targetting Russia. Retrieved January 5, 2022. ↩

  27. Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019. ↩

  28. MSTIC. (2021, May 28). Breaking down NOBELIUM’s latest early-stage toolset. Retrieved August 4, 2021. ↩

  29. F-Secure Labs. (2016, July). NANHAISHU RATing the South China Sea. Retrieved July 6, 2018. ↩

  30. Mavis, N. (2020, September 21). The Art and Science of Detecting Cobalt Strike. Retrieved April 6, 2021. ↩

  31. Namestnikov, Y. and Aime, F. (2019, May 8). FIN7.5: the infamous cybercrime rig “FIN7” continues its activities. Retrieved October 11, 2019. ↩

  32. Salem, E. (2020, November 17). CHAES: Novel Malware Targeting Latin American E-Commerce. Retrieved June 30, 2021. ↩

  33. Kuzmenko, A. et al. (2021, September 2). QakBot technical analysis. Retrieved September 27, 2021. ↩

  34. Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021. ↩

  35. Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021. ↩

  36. PT ESC Threat Intelligence. (2020, June 4). COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group. Retrieved March 2, 2021. ↩

  37. GReAT. (2019, April 10). Gaza Cybergang Group1, operation SneakyPastes. Retrieved May 13, 2020. ↩

  38. Chen, J. (2019, October 10). Magecart Card Skimmers Injected Into Online Shops. Retrieved September 9, 2020. ↩

  39. Carr, N., et al. (2018, August 01). On the Hunt for FIN7: Pursuing an Enigmatic and Evasive Global Criminal Operation. Retrieved August 23, 2018. ↩↩

  40. Platt, J. and Reeves, J.. (2019, March). FIN7 Revisited: Inside Astra Panel and SQLRat Malware. Retrieved June 18, 2019. ↩

  41. Skulkin, O.. (2019, January 20). Silence: Dissecting Malicious CHM Files and Performing Forensic Analysis. Retrieved May 24, 2019. ↩

  42. Hegel, T. (2021, January 13). A Global Perspective of the SideWinder APT. Retrieved January 27, 2021. ↩

  43. Rewterz. (2020, June 22). Analysis on Sidewinder APT Group – COVID-19. Retrieved January 29, 2021. ↩

  44. Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018. ↩

  45. Adair, S. and Lancaster, T. (2020, November 6). OceanLotus: Extending Cyber Espionage Operations Through Fake Websites. Retrieved November 20, 2020. ↩

  46. Symantec Threat Intelligence. (2020, June 25). WastedLocker: Symantec Identifies Wave of Attacks Against U.S. Organizations. Retrieved May 20, 2021. ↩

  47. Kim, J. et al. (2019, October). KIMSUKY GROUP: TRACKING THE KING OF THE SPEAR PHISHING. Retrieved November 2, 2020. ↩

  48. CISA, FBI, CNMF. (2020, October 27). https://us-cert.cisa.gov/ncas/alerts/aa20-301a. Retrieved November 4, 2020. ↩

  49. Proofpoint Staff. (2017, September 27). Threat Actor Profile: TA505, From Dridex to GlobeImposter. Retrieved May 28, 2019. ↩

  50. Proofpoint Staff. (2018, June 8). TA505 shifts with the times. Retrieved May 28, 2019. ↩

  51. Singh, S. et al.. (2018, March 13). Iranian Threat Group Updates Tactics, Techniques and Procedures in Spear Phishing Campaign. Retrieved April 11, 2018. ↩

  52. Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018. ↩

  53. Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018. ↩

  54. Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018. ↩

  55. Gorelik, M. (2018, October 08). Cobalt Group 2.0. Retrieved November 5, 2018. ↩

  56. Unit 42. (2018, October 25). New Techniques to Uncover and Attribute Financial actors Commodity Builders and Infrastructure Revealed. Retrieved December 11, 2018. ↩

  57. Giagone, R., Bermejo, L., and Yarochkin, F. (2017, November 20). Cobalt Strikes Again: Spam Runs Use Macros and CVE-2017-8759 Exploit Against Russian Banks. Retrieved March 7, 2019. ↩

  58. ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018. ↩

  59. Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018. ↩

  60. Porolli, M. (2020, July 9). More evil: A deep look at Evilnum and its toolset. Retrieved January 22, 2021. ↩

  61. Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 24, 2021. ↩

Back to top