Cross-source coverage

T1059.007 / ATT&CK

Command and Scripting Interpreter: JavaScript

153 rules · 149 families across 5 sources.

Showing deprecated rules · back to the default

From MITRE ATT&CK 19.2

Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.

JScript is the Microsoft implementation of the same scripting standard. JScript is interpreted via the Windows Script engine and thus integrated with many components of Windows such as the Component Object Model and Internet Explorer HTML Application (HTA) pages.

JavaScript for Automation (JXA) is a macOS scripting language based on JavaScript, included as part of Apple’s Open Scripting Architecture (OSA), that was introduced in OSX 10.10. Apple’s OSA provides scripting capabilities to control applications, interface with the operating system, and bridge access into the rest of Apple’s internal APIs. As of OSX 10.10, OSA only supports two languages, JXA and AppleScript. Scripts can be executed via the command line utility osascript, they can be compiled into applications or script files via osacompile, and they can be compiled and executed in memory of other programs by leveraging the OSAKit Framework.

Adversaries may abuse various implementations of JavaScript to execute various behaviors. Common uses include hosting malicious scripts on websites as part of a Drive-by Compromise or downloading and executing these script files as secondary payloads. Since these payloads are text-based, it is also very common for adversaries to obfuscate their content as part of Obfuscated Files or Information.

Tactics: Execution
Platforms: Linux · macOS · Windows
Telemetry: WinEventLog:Sysmonm365:defendermacos:unifiedlogmacos:osquerymacos:syslogauditd:SYSCALLlinux:syslog

How MITRE says to detect it DET0264

Cross-Platform Detection of JavaScript Execution Abuse

Windows Analytic 0733

Detects JavaScript execution through WSH (wscript.exe, cscript.exe) or HTA (mshta.exe), particularly when spawned from Office macros, web browsers, or abnormal user paths. Correlates script execution with outbound network activity or system modification.

WinEventLog:Sysmon EventCode=1
m365:defender ScriptBlockLogging + AMSI
WinEventLog:Sysmon EventCode=7

macOS Analytic 0734

Detects JavaScript for Automation (JXA) via osascript or compiled scripts using OSAKit APIs. Flags execution involving system modification, inter-process scripting, or browser abuse.

macos:unifiedlog log stream with predicate 'eventMessage CONTAINS "osascript"'
macos:osquery process_events
macos:syslog /var/log/system.log

Linux Analytic 0735

Detects Node.js or JavaScript interpreter execution from web shells, cron jobs, or local users. Correlates execution with reverse shell behavior, file modifications, or abnormal outbound connections.

auditd:SYSCALL execve
linux:syslog /var/log/syslog

View on attack.mitre.org ↗

elastic/protections-artifacts

81 rules · 80 families

Detection	Severity	Format
Abnormally Large Javascript Evaluation via Nodejs	Undefined	Elastic TOML
Command and Scripting Interpreter from Suspicious Parent	Undefined	Elastic TOML
Curl Download and Execution of JavaScript Payload	Undefined	Elastic TOML
Dynwrapx Image Load via Windows Scripts	Undefined	Elastic TOML
Execution from Unusual Directory	Undefined	Elastic TOML
Execution from ZIP File via Explorer	Undefined	Elastic TOML
Execution of a Downloaded Windows Script via Explorer	Undefined	Elastic TOML
Execution of a File Downloaded via Windows OpenSSH	Undefined	Elastic TOML
Execution of a File Written by Windows Script Host	Undefined	Elastic TOML
Execution of a Windows Script Downloaded from the Internet	Undefined	Elastic TOML

+ 71 more from elastic/protections-artifacts → showing the 10 highest-severity

elastic/detection-rules

36 rules

Detection	Severity	Format
Cassandra JavaScript UDF Creation	High	Elastic TOML
Command and Scripting Interpreter via Windows Scripts	High	Elastic TOML
Google Calendar C2 via Script Interpreter	High	Elastic TOML
Long Base64 Encoded Command via Scripting Interpreter	High	Elastic TOML
Potential Etherhiding C2 via Blockchain Connection	High	Elastic TOML
Potential JAVA/JNDI Exploitation Attempt	High	Elastic TOML
Potential SAP NetWeaver Exploitation	High	Elastic TOML
Potential SAP NetWeaver WebShell Creation	High	Elastic TOML
React2Shell (CVE-2025-55182) Exploitation Attempt	High	Elastic TOML
React2Shell Network Security Alert	High	Elastic TOML

+ 26 more from elastic/detection-rules → showing the 10 highest-severity

SigmaHQ/sigma

29 rules

Detection	Severity	Format
Adwind RAT / JRAT	High	Sigma
Adwind RAT / JRAT File Artifact	High	Sigma
Csc.EXE Execution Form Potentially Suspicious Parent	High	Sigma
Cscript/Wscript Uncommon Script Extension Execution	High	Sigma
HackTool - CACTUSTORCH Remote Thread Creation	High	Sigma
HackTool - Koadic Execution	High	Sigma
HTML Help HH.EXE Suspicious Child Process	High	Sigma
JXA In-memory Execution Via OSAScript	High	Sigma
MSHTA Execution with Suspicious File Extensions	High	Sigma
Potential Remote SquiblyTwo Technique Execution	High	Sigma

+ 19 more from SigmaHQ/sigma → showing the 10 highest-severity

splunk/security_content

5 rules

Detection	Severity	Format
Jscript Execution Using Cscript App	Undefined	SPL
MS Scripting Process Loading Ldap Module	Undefined	SPL
MS Scripting Process Loading WMI Module	Undefined	SPL
Windows Cmdline Tool Execution From Non-Shell Process	Undefined	SPL
Windows GrimResource - MMC Process Accessing APDS DLL	Undefined	SPL

Wazuh Core Ruleset

2 rules

Detection	Severity	Format
Suspicious execution of .js file by · win.eventdata.parentCommandLine = (?i)svchost.exe -k netsvcs -p, win.eventdata.commandLine = (?i)appdata\\\\.+\.exe.+\.js	Critical	Wazuh XML
XSS (Cross Site Scripting) attempt.	Medium	Wazuh XML