Article
GRU targeting of logistics firms: advisory AA25-141A
CISA, NSA, FBI and partners describe a GRU campaign against Western logistics and technology firms: targets, phases, CVEs and the fixes they list.
Read more
Attack technique
Command and Scripting Interpreter
Command and Scripting Interpreter is a technique where an attacker uses the built-in shells and scripting languages of a system to run commands, scripts or programs.
In short
Command and Scripting Interpreter is a technique where an attacker uses the built-in shells and scripting languages of a system to run commands, scripts or programs. Most systems already include these tools, so the activity can look like normal administration.
- Reconnaissance
- Resource Development
- Initial Access
- Execution
- Persistence
- Privilege Escalation
- Stealth
- Defense Impairment
- Credential Access
- Discovery
- Lateral Movement
- Collection
- Command and Control
- Exfiltration
- Impact
Execution · Step 4 Of 15 In The Attack Chain
- MITRE IDT1059ATT&CK technique
- Detection4ways to spot itUnusual interpreter launches · Suspicious follow-on activity
- Defences4ways to stop itRemove what you do not need · Control what can run
How it works
Most operating systems, cloud services and network devices include a command line or a scripting language. An attacker who gains access can use them to run commands without bringing in much new software.
Commands and scripts can arrive inside an initial access payload, be downloaded from a server the attacker controls, or be typed in through an interactive terminal or a remote service.
MITRE groups this technique into 13 sub-techniques, covering interpreters such as PowerShell, Unix shells, Python, JavaScript, network device command lines and cloud APIs. The sub-techniques are T1059.001 PowerShell, T1059.002 AppleScript, T1059.003 Windows Command Shell, T1059.004 Unix Shell, T1059.005 Visual Basic, T1059.006 Python, T1059.007 JavaScript, T1059.008 Network Device CLI, T1059.009 Cloud API, T1059.010 AutoHotKey & AutoIT, T1059.011 Lua, T1059.012 Hypervisor CLI and T1059.013 Container CLI/API.
A real example
- MITRE ATT&CK lists Empire as using a command-line interface to interact with systems.
- MITRE ATT&CK lists Donut as able to generate shellcode outputs that run through Ruby.
- MITRE ATT&CK lists Bonadan as able to create bind and reverse shells on an infected system.
- MITRE ATT&CK lists APT37 as using Ruby scripts to run payloads.
- MITRE ATT&CK lists APT39 as using custom scripts to carry out internal reconnaissance.
Who uses it
- Ransomware group Medusa Medusa is a ransomware-as-a-service operation first identified in June 2021, according to the FBI, CISA and HHS. Active · Since 2021 · Ransomware as a service (closed group until at least early 2023)
- Ransomware group Qilin Qilin, also tracked as Agenda, is a ransomware as a service family that MITRE ATT&CK says has been active since at least 2022. Active · Since 2022 · Ransomware as a service
- Ransomware group Rhysida Rhysida is a ransomware operation that CISA, the FBI and the MS-ISAC say has mainly been deployed against education, healthcare, manufacturing, IT and government organizations since May 2023. Active · Since 2023 · Ransomware as a service (profit-sharing with associates)
Seen in incidents
- Incident Kyiv substation attack with Industroyer On 17 December 2016, malware called Industroyer, also known as CrashOverride, disrupted a transmission substation outside Kyiv, Ukraine. December 2016 · Energy and utilities
- Incident SingHealth patient database attack, 2018 Between August 2017 and July 2018 an attacker broke into the network of SingHealth, Singapore's largest public healthcare group, and copied the records of almost 1.5 million patients, mainly names, ID numbers, addresses and dates of birth. August 2017 to July 2018 · Healthcare
How to detect
-
Unusual interpreter launches
Watch for shells and script engines started outside normal working hours, by unexpected users, or by processes that would not normally start them.
-
Suspicious follow-on activity
Look for interpreter use that is followed by encoded or hidden arguments, or by other tools used to download or connect to remote systems.
-
Unexpected access on special platforms
On virtualization hosts and network devices, watch for interpreter or command line access by uncommon accounts or from unknown addresses.
-
Data sources MITRE lists
Command Execution, Process Creation, User Account Authentication
How to defend
-
Remove what you do not need
Turn off or uninstall shells and interpreters that are not required, and block installation of new ones without approval.
-
Control what can run
Use application controls and, where possible, allow only signed scripts. Language restriction modes can limit sensitive functions.
-
Limit who can use them
Restrict interpreter use and execution policy to administrators where feasible, and keep an inventory of the interpreters on your systems.
-
Use endpoint protections
Anti-malware can quarantine suspicious files, and attack surface reduction rules can stop scripts from running harmful downloaded content.
Questions
What is the Command and Scripting Interpreter technique?
T1059 is when an attacker uses built-in shells and scripting languages to run commands, scripts or programs. Most systems already include these tools, so the activity can look like normal administration.
Which interpreters does it cover?
MITRE groups it into 13 sub-techniques, covering PowerShell, Unix shells, Python, JavaScript, network device command lines and cloud APIs. Most systems already include these tools.
How can I detect abuse of interpreters?
Watch for shells and script engines started outside working hours, by unexpected users or by processes that would not normally start them, especially followed by encoded or hidden arguments.
How do I defend against it?
Remove interpreters you do not need, use application controls and signed scripts where possible, restrict interpreter use to administrators, and use anti-malware and attack surface reduction rules.
In our research
- GRU targeting of logistics firms: advisory AA25-141A October 2026
- Akira ransomware advisory AA24-109A: stages and tools October 2026
- ATT&CK groups by attributed origin: what is mapped October 2026
- ATT&CK techniques most used across threat groups October 2026
- WIRTE: Covert Espionage Actor Targeting the Middle East and Beyond July 2026
- Konni (Vedalia / TA406 / Opal Sleet): North Korea’s Steady Hand in Espionage Operations March 2026
Sources
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.