MITRE ATT&CK - Técnica

T1059: Command and Scripting Interpreter

Command and Scripting Interpreter (T1059) é uma técnica catalogada no MITRE ATT&CK Enterprise usada como referência para mapear comportamento adversário em auditorias de segurança.

Técnica T1059 Enterprise ATT&CK

Contexto para AppSec

Em uma auditoria de AppSec, Command and Scripting Interpreter deve ser usada para revisar caminhos em que código, configuração, dependências ou infraestrutura podem viabilizar o comportamento descrito pela MITRE. No ATT&CK, ela aparece em Execution. As plataformas mapeadas pela MITRE incluem Containers, ESXi, IaaS, Identity Provider, Linux, macOS, Network Devices, Office Suite e mais 2. No Vigly, esse contexto ajuda a conectar evidências do repositório com priorização e remediação.

Tática/fase Execution
Plataformas MITRE Containers, ESXi, IaaS, Identity Provider, Linux, macOS, Network Devices, Office Suite, SaaS, Windows

Descrição oficial original do MITRE ATT&CK

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell. There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic. Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services in order to achieve remote Execution.

Ver fonte oficial no MITRE ATT&CK

Como o Vigly audita a técnica Command and Scripting Interpreter automaticamente na sua pipeline

O Vigly cruza sinais de SAST, modelagem de ameaças, regras de negócio e evidências do repositório para priorizar riscos reais antes que eles cheguem à produção.

Conhecer a plataforma