T1059: Command and Scripting Interpreter

PowerShell is a powerful task automation framework and scripting engine. Widely abused by threat actors for in-memory execution (fileless malware), credential dumping, remote command execution, and AMSI bypasses.

CScript.exe is a command-line version of the Windows Script Host that facilitates running VBScript and JScript scripts. Frequently abused to run dropped scripts, execute obfuscated VBScript files, and perform defense evasion.

The command-line interpreter in Windows

dotnet.exe comes with .NET Framework

64-bit FSharp (F#) Interpreter included with Visual Studio and DotNet Core SDK.

32/64-bit FSharp (F#) Interpreter included with Visual Studio.

Find searches directory trees for files matching criteria. When configured with SUID permissions or sudo privileges without restrictions, its -exec flag can spawn root shells or execute arbitrary commands.

Curl is a tool to transfer data from or to a server using supported protocols (HTTP, HTTPS, FTP, etc.). Attackers leverage curl to download malicious second-stage scripts and pipe directly into bash or sh for fileless in-memory execution.

The GNU Bourne Again SHell (bash) is the default interactive shell on most Linux distributions. Abused for spawning interactive reverse TCP shells, executing encoded base64 commands, and privilege escalation.

Socat is a command-line based utility that establishes two bidirectional byte streams and transfers data between them. Attackers use socat to establish encrypted TTY reverse shells and tunnel traffic across isolated network zones.

Python is a high-level interpreted programming language. Frequently pre-installed on Linux systems and abused by adversaries for full-fledged reverse shells, PTY spawning, local port forwarding, and script execution.

AWK is a pattern scanning and processing language. Because AWK includes built-in system() functions and file operations, SUID awk or sudo privileges can be trivially abused to break out of restricted environments and spawn shells.

GNU tar is an archiving utility. Attackers abuse tar checkpoint execution options (--checkpoint-action=exec) to spawn an interactive shell or execute arbitrary commands when running with sudo or SUID permissions.

OpenSSL is a cryptography toolkit. Attackers leverage openssl s_client to establish encrypted TLS reverse shell sessions or exfiltrate sensitive files across monitored networks.

Vim is an interactive screen text editor. When configured with SUID permissions or privileged sudo rights without command restrictions, attackers escape into a root shell via the :! command.

Nmap is a network exploration tool and security scanner. Attackers use custom Nmap Scripting Engine (NSE) scripts to execute arbitrary root shell commands when nmap has SUID or sudo grants.

Netcat is a versatile networking tool for TCP and UDP communication. Attackers frequently use it in conjunction with FIFOs or the -e flag to establish interactive reverse command shells.

Perl is a general-purpose programming language widely installed on Linux servers. Attackers execute socket-creation one-liners to spawn interactive reverse shells directly in memory.

Ruby is an interpreted programming language. Attackers use ruby -e one-liners to execute shell breakouts, spawn interactive PTY shells, or establish network socket connections.

GNU Debugger (gdb) allows code inspection and execution. When granted SUID permissions or privileged sudo rights, gdb can execute arbitrary shell commands prior to loading programs.

Less is an interactive terminal file pager. When invoked via sudo without secure mode, operators can escape to an interactive shell by issuing !/bin/sh from within the viewer.

More is a terminal filter for paging text. Like less, running more on terminal outputs allows executing interactive shell escapes via !/bin/sh.

Xargs builds and executes command lines from standard input. SUID xargs can execute an interactive root shell retaining elevated permissions.

Strace intercepts and records system calls. When run with SUID permissions, strace executes target binaries with preserved root privileges.

Timeout runs a command with a time limit. SUID timeout launches child programs with preserved elevated permissions.

Ionice sets or gets process I/O scheduling class and priority. SUID ionice launches child programs with elevated privileges.

Nice runs a program with modified scheduling priority. SUID nice spawns child programs retaining elevated EUID permissions.

Osascript executes Open Scripting Architecture (OSA) scripts such as AppleScript and JavaScript for Automation (JXA). Widely used in macOS malware to display convincing phishing dialogs, harvest credentials, control System Events, and execute shell commands.

Installer runs system software installations. Attackers run installer from terminal with root privileges to deploy malicious package files silently without user prompts.