Description
Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows technologies such as Component Object Model and the Native API through the Windows API. Although tagged as legacy with no planned future evolutions, VB is integrated and supported in the .NET Framework and cross-platform .NET Core.(Citation: VB .NET Mar 2020)(Citation: VB Microsoft)
Derivative languages based on VB have also been created, such as Visual Basic for Applications (VBA) and VBScript. VBA is an event-driven programming language built into Microsoft Office, as well as several third-party applications.(Citation: Microsoft VBA)(Citation: Wikipedia VBA) VBA enables documents to contain macros used to automate the execution of tasks and other functionality on the host. VBScript is a default scripting language on Windows hosts and can also be used in place of JavaScript on HTML Application (HTA) webpages served to Internet Explorer (though most modern browsers do not come with VBScript support).(Citation: Microsoft VBScript)
Adversaries may use VB payloads to execute malicious commands. Common malicious usage includes automating execution of behaviors with VBScript or embedding VBA content into Spearphishing Attachment payloads (which may also involve Mark-of-the-Web Bypass to enable execution).(Citation: Default VBS macros Blocking )
Reverse Shell Cheatsheet
Read our in-depth pentesting guide related to this technique
Platforms
Mitigations (5)
Restrict Web-Based ContentM1021
Script blocking extensions can help prevent the execution of scripts and HTA files that may commonly be used during the exploitation process. For malicious code served up through ads, adblockers can help prevent that code from executing in the first place.
Execution PreventionM1038
Use application control where appropriate. VBA macros obtained from the Internet, based on the file's Mark of the Web (MOTW) attribute, may be blocked from executing in Office applications (ex: Access, Excel, PowerPoint, Visio, and Word) by default starting in Windows Version 2203.(Citation: Default VBS macros Blocking )
Behavior Prevention on EndpointM1040
On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent Visual Basic scripts from executing potentially malicious downloaded content (Citation: win10_asr).
Antivirus/AntimalwareM1049
Anti-virus can be used to automatically quarantine suspicious files.
Disable or Remove Feature or ProgramM1042
Turn off or restrict access to unneeded VB components.
Threat Groups (46)
| ID | Group | Context |
|---|---|---|
| G0082 | APT38 | [APT38](https://attack.mitre.org/groups/G0082) has used VBScript to execute commands and other operational tasks.(Citation: CISA AA20-239A BeagleBoyz ... |
| G1008 | SideCopy | [SideCopy](https://attack.mitre.org/groups/G1008) has sent Microsoft Office Publisher documents to victims that have embedded malicious macros that ex... |
| G0094 | Kimsuky | [Kimsuky](https://attack.mitre.org/groups/G0094) has used Visual Basic to download malicious payloads.(Citation: ThreatConnect Kimsuky September 2020)... |
| G0040 | Patchwork | [Patchwork](https://attack.mitre.org/groups/G0040) used Visual Basic Scripts (VBS) on victim machines.(Citation: TrendMicro Patchwork Dec 2017)(Citati... |
| G0078 | Gorgon Group | [Gorgon Group](https://attack.mitre.org/groups/G0078) has used macros in [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001)s as... |
| G0050 | APT32 | [APT32](https://attack.mitre.org/groups/G0050) has used macros, COM scriptlets, and VBS scripts.(Citation: Cybereason Oceanlotus May 2017)(Citation: C... |
| G0069 | MuddyWater | [MuddyWater](https://attack.mitre.org/groups/G0069) has used VBScript files to execute its [POWERSTATS](https://attack.mitre.org/software/S0223) paylo... |
| G0047 | Gamaredon Group | [Gamaredon Group](https://attack.mitre.org/groups/G0047) has embedded malicious macros in document templates, which executed VBScript. [Gamaredon Grou... |
| G0046 | FIN7 | [FIN7](https://attack.mitre.org/groups/G0046) used VBS scripts to help perform tasks on the victim's machine.(Citation: FireEye FIN7 Aug 2018)(Citatio... |
| G0034 | Sandworm Team | [Sandworm Team](https://attack.mitre.org/groups/G0034) has created VBScripts to run an SSH server.(Citation: ESET BlackEnergy Jan 2016)(Citation: ESET... |
| G0095 | Machete | [Machete](https://attack.mitre.org/groups/G0095) has embedded malicious macros within spearphishing attachments to download additional files.(Citation... |
| G0121 | Sidewinder | [Sidewinder](https://attack.mitre.org/groups/G0121) has used VBScript to drop and execute malware loaders.(Citation: ATT Sidewinder January 2021) |
| G0129 | Mustang Panda | [Mustang Panda](https://attack.mitre.org/groups/G0129) has embedded VBScript components in LNK files to download additional files and automate collect... |
| G0087 | APT39 | [APT39](https://attack.mitre.org/groups/G0087) has utilized malicious VBS scripts in malware.(Citation: FBI FLASH APT39 September 2020) |
| G1052 | Contagious Interview | [Contagious Interview](https://attack.mitre.org/groups/G1052) has utilized Visual Basic scripts in the execution of their downloader malware targeting... |
| G1018 | TA2541 | [TA2541](https://attack.mitre.org/groups/G1018) has used VBS files to execute or establish persistence for additional payloads, often using file names... |
| G0067 | APT37 | [APT37](https://attack.mitre.org/groups/G0067) executes shellcode and a VBA script to decode Base64 strings.(Citation: Talos Group123) |
| G0049 | OilRig | [OilRig](https://attack.mitre.org/groups/G0049) has used VBScript macros for execution on compromised hosts.(Citation: Check Point APT34 April 2021) |
| G0126 | Higaisa | [Higaisa](https://attack.mitre.org/groups/G0126) has used VBScript code on the victim's machine.(Citation: PTSecurity Higaisa 2020) |
| G0062 | TA459 | [TA459](https://attack.mitre.org/groups/G0062) has a VBScript for execution.(Citation: Proofpoint TA459 April 2017) |
Associated Software (69)
| ID | Name | Type | Context |
|---|---|---|---|
| S1039 | Bumblebee | Malware | [Bumblebee](https://attack.mitre.org/software/S1039) can create a Visual Basic script to enable persistence.(Citation: Proofpoint Bumblebee April 2022... |
| S0343 | Exaramel for Windows | Malware | [Exaramel for Windows](https://attack.mitre.org/software/S0343) has a command to execute VBS scripts on the victim’s machine.(Citation: ESET TeleBots ... |
| S0226 | Smoke Loader | Malware | [Smoke Loader](https://attack.mitre.org/software/S0226) adds a Visual Basic script in the Startup folder to deploy the payload.(Citation: Malwarebytes... |
| S1193 | TAMECAT | Malware | [TAMECAT](https://attack.mitre.org/software/S1193) has used VBScript to query anti-virus products.(Citation: Mandiant APT42-untangling) |
| S0386 | Ursnif | Malware | [Ursnif](https://attack.mitre.org/software/S0386) droppers have used VBA macros to download and execute the malware's full executable payload.(Citatio... |
| S0198 | NETWIRE | Malware | [NETWIRE](https://attack.mitre.org/software/S0198) has been executed through use of VBScripts.(Citation: FireEye NETWIRE March 2019)(Citation: Proofpo... |
| S0367 | Emotet | Malware | [Emotet](https://attack.mitre.org/software/S0367) has sent Microsoft Word documents with embedded macros that will invoke scripts to download addition... |
| S9001 | SystemBC | Malware | [SystemBC](https://attack.mitre.org/software/S9001) has leveraged VBScript to execute malicious code.(Citation: SophosGnGal_SystemBC_Dec2020) |
| S1030 | Squirrelwaffle | Malware | [Squirrelwaffle](https://attack.mitre.org/software/S1030) has used malicious VBA macros in Microsoft Word documents and Excel spreadsheets that execut... |
| S1178 | ShrinkLocker | Malware | [ShrinkLocker](https://attack.mitre.org/software/S1178) is a VisualBasic script (VBS) object that calls multiple other operating system functions duri... |
| S1086 | Snip3 | Malware | [Snip3](https://attack.mitre.org/software/S1086) can use visual basic scripts for first-stage execution.(Citation: Morphisec Snip3 May 2021)(Citation:... |
| S0689 | WhisperGate | Malware | [WhisperGate](https://attack.mitre.org/software/S0689) can use a Visual Basic script to exclude the `C:\` drive from Windows Defender.(Citation: Unit ... |
| S1122 | Mispadu | Malware | [Mispadu](https://attack.mitre.org/software/S1122)’s dropper uses VBS files to install payloads and perform execution.(Citation: SCILabs Malteiro 2021... |
| S0483 | IcedID | Malware | [IcedID](https://attack.mitre.org/software/S0483) has used obfuscated VBA string expressions.(Citation: Juniper IcedID June 2020) |
| S0441 | PowerShower | Malware | [PowerShower](https://attack.mitre.org/software/S0441) has the ability to save and execute VBScript.(Citation: Unit 42 Inception November 2018) |
| S1149 | CHIMNEYSWEEP | Malware | [CHIMNEYSWEEP](https://attack.mitre.org/software/S1149) has executed a script named cln.vbs on compromised hosts.(Citation: Mandiant ROADSWEEP August ... |
| S0696 | Flagpro | Malware | [Flagpro](https://attack.mitre.org/software/S0696) can execute malicious VBA macros embedded in .xlsm files.(Citation: NTT Security Flagpro new Decemb... |
| S0387 | KeyBoy | Malware | [KeyBoy](https://attack.mitre.org/software/S0387) uses VBS scripts for installing files and performing execution.(Citation: CitizenLab KeyBoy Nov 2016... |
| S0147 | Pteranodon | Malware | [Pteranodon](https://attack.mitre.org/software/S0147) can use a malicious VBS file for execution.(Citation: Symantec Shuckworm January 2022) |
| S0240 | ROKRAT | Malware | [ROKRAT](https://attack.mitre.org/software/S0240) has used Visual Basic for execution.(Citation: Malwarebytes RokRAT VBA January 2021) |
Related CWE Weaknesses
References
- .NET Team. (2020, March 11). Visual Basic support planned for .NET 5.0. Retrieved June 23, 2020.
- Kellie Eickmeyer. (2022, February 7). Helping users stay safe: Blocking internet macros by default in Office. Retrieved February 7, 2022.
- Microsoft. (2011, April 19). What Is VBScript?. Retrieved March 28, 2020.
- Microsoft. (2019, June 11). Office VBA Reference. Retrieved June 23, 2020.
- Microsoft. (n.d.). Visual Basic documentation. Retrieved June 23, 2020.
- Wikipedia. (n.d.). Visual Basic for Applications. Retrieved August 13, 2020.
Frequently Asked Questions
What is T1059.005 (Visual Basic)?
T1059.005 is a MITRE ATT&CK technique named 'Visual Basic'. It belongs to the Execution tactic(s). Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows technologies such as [Component Object Model](https://a...
How can T1059.005 be detected?
Detection of T1059.005 (Visual Basic) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1059.005?
There are 5 documented mitigations for T1059.005. Key mitigations include: Restrict Web-Based Content, Execution Prevention, Behavior Prevention on Endpoint, Antivirus/Antimalware, Disable or Remove Feature or Program.
Which threat groups use T1059.005?
Known threat groups using T1059.005 include: APT38, SideCopy, Kimsuky, Patchwork, Gorgon Group, APT32, MuddyWater, Gamaredon Group.