EXPLORE

← Back to Explore

T1059.005

Visual Basic

Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows technologies such as [Component Object Model](https://attack.mitre.org/techniques/T1559/001) and the [Native API](https://attack.mitre.org/techniques/T1106) through the Windows API. Although tagged as legacy with no planned future evolutions, VB is integrated and supported in the .NET Framework and cross-platform .NET Core.(Citation: VB .NET Mar 2020)(C...

LinuxmacOSWindows

66

Detections

4

Sources

45

Threat Actors

BY SOURCE

22sigma19sublime18elastic7splunk_escu

PROCEDURES (40)

Process Creation Monitoring5 detections

Auto-extracted: 5 detections for process creation monitoring

Script Execution Monitoring4 detections

Auto-extracted: 4 detections for script execution monitoring

Macro4 detections

Auto-extracted: 4 detections for macro

Child Process4 detections

Auto-extracted: 4 detections for child process

Phish3 detections

Auto-extracted: 3 detections for phish

Parent Process3 detections

Auto-extracted: 3 detections for parent process

File Monitoring2 detections

Auto-extracted: 2 detections for file monitoring

General Monitoring2 detections

Auto-extracted: 2 detections for general monitoring

Office2 detections

Auto-extracted: 2 detections for office

Attachment2 detections

Auto-extracted: 2 detections for attachment

Network Connection Monitoring2 detections

Auto-extracted: 2 detections for network connection monitoring

Powershell2 detections

Auto-extracted: 2 detections for powershell

Suspicious2 detections

Auto-extracted: 2 detections for suspicious

Download2 detections

Auto-extracted: 2 detections for download

Remote2 detections

Auto-extracted: 2 detections for remote

Wmi1 detections

Auto-extracted: 1 detections for wmi

Exfiltrat1 detections

Auto-extracted: 1 detections for exfiltrat

Email1 detections

Auto-extracted: 1 detections for email

Attachment1 detections

Auto-extracted: 1 detections for attachment

Obfuscat1 detections

Auto-extracted: 1 detections for obfuscat

Wmi1 detections

Auto-extracted: 1 detections for wmi

Email Security1 detections

Auto-extracted: 1 detections for email security

Wmi1 detections

Auto-extracted: 1 detections for wmi

Evasion1 detections

Auto-extracted: 1 detections for evasion

Http1 detections

Auto-extracted: 1 detections for http

Registry1 detections

Auto-extracted: 1 detections for registry

Privilege1 detections

Auto-extracted: 1 detections for privilege

Registry1 detections

Auto-extracted: 1 detections for registry

Office1 detections

Auto-extracted: 1 detections for office

Persist1 detections

Auto-extracted: 1 detections for persist

Bypass1 detections

Auto-extracted: 1 detections for bypass

Service1 detections

Auto-extracted: 1 detections for service

Service1 detections

Auto-extracted: 1 detections for service

Dns1 detections

Auto-extracted: 1 detections for dns

Office1 detections

Auto-extracted: 1 detections for office

Download1 detections

Auto-extracted: 1 detections for download

Remote1 detections

Auto-extracted: 1 detections for remote

Macro1 detections

Auto-extracted: 1 detections for macro

Office1 detections

Auto-extracted: 1 detections for office

Obfuscat1 detections

Auto-extracted: 1 detections for obfuscat

DETECTIONS (66)

Adwind RAT / JRAT File Artifact

AppLocker Prevented Application or Script from Running

Attachment soliciting user to enable macros

Attachment with auto-executing macro (unsolicited)

Attachment with auto-opening VBA macro (unsolicited)

Attachment with high risk VBA macro (unsolicited)

Attachment with macro calling executable

Attachment with VBA macros from employee impersonation (unsolicited)

Attachment: Archive contains DLL-loading macro

Attachment: CVE-2021-40444 - MSHTML Remote Code Execution Vulnerability

sublimecritical

Attachment: CVE-2025-24071 - Microsoft Windows File Explorer Spoofing Vulnerability

sublimecritical

Attachment: Encrypted Microsoft Office file (unsolicited)

Attachment: Excel file with document sharing lure created by Go Excelize

Attachment: Excel file with suspicious template identifier

Attachment: Macro files containing MHT content

Attachment: Macro with suspected use of COM ShellBrowserWindow object for process creation

Attachment: Potential sandbox evasion in Office file

Attachment: QR code link with base64-encoded recipient address

Attachment: USDA bid invitation impersonation

Attachment: XLSX file with suspicious print titles metadata

Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI

Cisco NVM - Susp Script From Archive Triggering Network Activity

Command and Scripting Interpreter via Windows Scripts

Csc.EXE Execution Form Potentially Suspicious Parent

Cscript/Wscript Uncommon Script Extension Execution

Delayed Execution via Ping

Execute Javascript With Jscript COM CLSID

Execution of a Downloaded Windows Script

HackTool - CACTUSTORCH Remote Thread Creation

HackTool - Koadic Execution

HTML Help HH.EXE Suspicious Child Process

Microsoft Build Engine Started by a Script Process

Microsoft Management Console File from Unusual Path

MMC Loading Script Engines DLLs

Potential Dropper Script Execution Via WScript/CScript

Potential Reconnaissance Activity Via GatherNetworkInfo.VBS

Potential Remote SquiblyTwo Technique Execution

Registry Modification Attempt Via VBScript

Registry Modification Attempt Via VBScript - PowerShell

Registry Tampering by Potentially Suspicious Processes

Remote File Download via Script Interpreter

Remote XSL Script Execution via COM

Scheduled Task Created by a Windows Script

Script Execution via Microsoft HTML Application

Script Interpreter Connection to Non-Standard Port

Service Control Spawned via Script Interpreter

Suspicious .NET Code Compilation

Suspicious Child Process Of BgInfo.EXE

Suspicious Explorer Child Process

Suspicious HH.EXE Execution

Suspicious Process DNS Query Known Abuse Web Services

Suspicious Process With Discord DNS Query

Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS

Suspicious ScreenConnect Client Child Process

Suspicious Scripting in a WMI Consumer

Suspicious VBA macros from untrusted sender

Uncommon Child Process Of BgInfo.EXE

Vbscript Execution Using Wscript App

Web Shell Detection: Script Process Child of Common Web Processes

Windows Outlook Macro Created by Suspicious Process

Windows Script Executing PowerShell

Windows Script Execution from Archive

Windows Script Interpreter Executing Process via WMI

Windows Shell/Scripting Processes Spawning Suspicious Programs

WScript or CScript Dropper - File

XSL Script Execution Via WMIC.EXE