Command and Scripting Interpreter
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of [Unix Shell](https://attack.mitre.org/techniques/T1059/004) while Windows installations include the [Windows C...
BY SOURCE
PROCEDURES (181)
Auto-extracted: 30 detections for process creation monitoring
Auto-extracted: 27 detections for general monitoring
Auto-extracted: 24 detections for script execution monitoring
Auto-extracted: 10 detections for persist
Auto-extracted: 9 detections for amsi
Auto-extracted: 8 detections for exfiltrat
Auto-extracted: 8 detections for script block
Auto-extracted: 8 detections for suspicious
Auto-extracted: 8 detections for privilege
Auto-extracted: 7 detections for download
Auto-extracted: 6 detections for http
Auto-extracted: 6 detections for child process
Auto-extracted: 6 detections for parent process
Auto-extracted: 5 detections for suspicious
Auto-extracted: 5 detections for parent process
Auto-extracted: 5 detections for email
Auto-extracted: 5 detections for phish
Auto-extracted: 5 detections for network connection monitoring
Auto-extracted: 5 detections for attachment
Auto-extracted: 5 detections for exfiltrat
Auto-extracted: 5 detections for obfuscat
Auto-extracted: 5 detections for inject
Auto-extracted: 5 detections for service
Auto-extracted: 5 detections for email
Auto-extracted: 5 detections for base64
Auto-extracted: 5 detections for container
Auto-extracted: 5 detections for suspicious
Auto-extracted: 5 detections for remote
Auto-extracted: 4 detections for service
Auto-extracted: 4 detections for kubernetes
Auto-extracted: 4 detections for startup
Auto-extracted: 4 detections for remote
Auto-extracted: 4 detections for container
Auto-extracted: 4 detections for download
Auto-extracted: 4 detections for powershell
Auto-extracted: 4 detections for bypass
Auto-extracted: 4 detections for bypass
Auto-extracted: 4 detections for command and control
Auto-extracted: 4 detections for child process
Auto-extracted: 4 detections for powershell
Auto-extracted: 3 detections for unusual
Auto-extracted: 3 detections for powershell
Auto-extracted: 3 detections for child process
Auto-extracted: 3 detections for suspicious
Auto-extracted: 3 detections for phish
Auto-extracted: 3 detections for ransomware
Auto-extracted: 3 detections for credential
Auto-extracted: 3 detections for service
Auto-extracted: 3 detections for remote
Auto-extracted: 3 detections for child process
Auto-extracted: 3 detections for azure
Auto-extracted: 3 detections for kubernetes
Auto-extracted: 3 detections for c2
Auto-extracted: 3 detections for inject
Auto-extracted: 3 detections for powershell
Auto-extracted: 3 detections for unusual
Auto-extracted: 3 detections for token
Auto-extracted: 3 detections for authentication monitoring
Auto-extracted: 3 detections for aws
Auto-extracted: 3 detections for persist
Auto-extracted: 3 detections for base64
Auto-extracted: 2 detections for child process
Auto-extracted: 2 detections for aws
Auto-extracted: 2 detections for suspicious
Auto-extracted: 2 detections for command line monitoring
Auto-extracted: 2 detections for attachment
Auto-extracted: 2 detections for attachment
Auto-extracted: 2 detections for office
Auto-extracted: 2 detections for macro
Auto-extracted: 2 detections for kubernetes
Auto-extracted: 2 detections for c2
Auto-extracted: 2 detections for lateral
Auto-extracted: 2 detections for persist
Auto-extracted: 2 detections for service
Auto-extracted: 2 detections for inject
Auto-extracted: 2 detections for http
Auto-extracted: 2 detections for unusual
Auto-extracted: 2 detections for exfiltrat
Auto-extracted: 2 detections for privilege
Auto-extracted: 2 detections for office
Auto-extracted: 2 detections for c2
Auto-extracted: 2 detections for parent process
Auto-extracted: 2 detections for email
Auto-extracted: 2 detections for kerbero
Auto-extracted: 1 detections for registry
Auto-extracted: 1 detections for obfuscat
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for module load monitoring
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for azure
Auto-extracted: 1 detections for obfuscat
Auto-extracted: 1 detections for base64
Auto-extracted: 1 detections for kernel
Auto-extracted: 1 detections for cloud
Auto-extracted: 1 detections for encrypt
Auto-extracted: 1 detections for kernel
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for evasion
Auto-extracted: 1 detections for azure
Auto-extracted: 1 detections for wmi
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for office
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for service monitoring
Auto-extracted: 1 detections for amsi
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for token
Auto-extracted: 1 detections for anomal
Auto-extracted: 1 detections for base64
Auto-extracted: 1 detections for command and control
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for encrypt
Auto-extracted: 1 detections for container
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for tamper
Auto-extracted: 1 detections for amsi
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for macro
Auto-extracted: 1 detections for script block
Auto-extracted: 1 detections for tamper
Auto-extracted: 1 detections for ransomware
Auto-extracted: 1 detections for macro
Auto-extracted: 1 detections for download
Auto-extracted: 1 detections for kernel monitoring
Auto-extracted: 1 detections for evasion
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for cloud monitoring
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for scheduled task
Auto-extracted: 1 detections for wmi
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for encrypt
Auto-extracted: 1 detections for macro
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for kernel
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for amsi
Auto-extracted: 1 detections for registry
Auto-extracted: 1 detections for amsi
Auto-extracted: 1 detections for evasion
Auto-extracted: 1 detections for wmi
Auto-extracted: 1 detections for registry
Auto-extracted: 1 detections for container
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for c2
Auto-extracted: 1 detections for anomal
Auto-extracted: 1 detections for command and control
Auto-extracted: 1 detections for encrypt
Auto-extracted: 1 detections for tamper
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for parent process
Auto-extracted: 1 detections for parent process
Auto-extracted: 1 detections for dump
Auto-extracted: 1 detections for scheduled task
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for ransomware
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for process access
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for cloud
Auto-extracted: 1 detections for cloud
Auto-extracted: 1 detections for token
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for ransomware
Auto-extracted: 1 detections for parent process
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for dump
Auto-extracted: 1 detections for attachment
Auto-extracted: 1 detections for anomal
Auto-extracted: 1 detections for attachment
Auto-extracted: 1 detections for wmi
Auto-extracted: 1 detections for aws
Auto-extracted: 1 detections for amsi