Description
Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.(Citation: NodeJS)
JScript is the Microsoft implementation of the same scripting standard. JScript is interpreted via the Windows Script engine and thus integrated with many components of Windows such as the Component Object Model and Internet Explorer HTML Application (HTA) pages.(Citation: JScrip May 2018)(Citation: Microsoft JScript 2007)(Citation: Microsoft Windows Scripts)
JavaScript for Automation (JXA) is a macOS scripting language based on JavaScript, included as part of Apple’s Open Scripting Architecture (OSA), that was introduced in OSX 10.10. Apple’s OSA provides scripting capabilities to control applications, interface with the operating system, and bridge access into the rest of Apple’s internal APIs. As of OSX 10.10, OSA only supports two languages, JXA and AppleScript. Scripts can be executed via the command line utility osascript, they can be compiled into applications or script files via osacompile, and they can be compiled and executed in memory of other programs by leveraging the OSAKit Framework.(Citation: Apple About Mac Scripting 2016)(Citation: SpecterOps JXA 2020)(Citation: SentinelOne macOS Red Team)(Citation: Red Canary Silver Sparrow Feb2021)(Citation: MDSec macOS JXA and VSCode)
Adversaries may abuse various implementations of JavaScript to execute various behaviors. Common uses include hosting malicious scripts on websites as part of a Drive-by Compromise or downloading and executing these script files as secondary payloads. Since these payloads are text-based, it is also very common for adversaries to obfuscate their content as part of Obfuscated Files or Information.
Reverse Shell Cheatsheet
Read our in-depth pentesting guide related to this technique
Platforms
Mitigations (4)
Restrict Web-Based ContentM1021
Script blocking extensions can help prevent the execution of JavaScript and HTA files that may commonly be used during the exploitation process. For malicious code served up through ads, adblockers can help prevent that code from executing in the first place.
Execution PreventionM1038
Denylist scripting where appropriate.
Behavior Prevention on EndpointM1040
On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent JavaScript scripts from executing potentially malicious downloaded content (Citation: win10_asr).
Disable or Remove Feature or ProgramM1042
Turn off or restrict access to unneeded scripting components.
Threat Groups (28)
| ID | Group | Context |
|---|---|---|
| G0119 | Indrik Spider | [Indrik Spider](https://attack.mitre.org/groups/G0119) has used malicious JavaScript files for several components of their attack.(Citation: Symantec ... |
| G0094 | Kimsuky | [Kimsuky](https://attack.mitre.org/groups/G0094) has used JScript for logging and downloading additional tools.(Citation: VirusBulletin Kimsuky Octobe... |
| G1037 | TA577 | [TA577](https://attack.mitre.org/groups/G1037) has used JavaScript to execute additional malicious payloads.(Citation: Latrodectus APR 2024) |
| G0120 | Evilnum | [Evilnum](https://attack.mitre.org/groups/G0120) has used malicious JavaScript files on the victim's machine.(Citation: ESET EvilNum July 2020) |
| G0050 | APT32 | [APT32](https://attack.mitre.org/groups/G0050) has used JavaScript for drive-by downloads and C2 communications.(Citation: Cybereason Cobalt Kitty 201... |
| G0069 | MuddyWater | [MuddyWater](https://attack.mitre.org/groups/G0069) has used JavaScript files to execute its [POWERSTATS](https://attack.mitre.org/software/S0223) pay... |
| G0037 | FIN6 | [FIN6](https://attack.mitre.org/groups/G0037) has used malicious JavaScript to steal payment card data from e-commerce sites.(Citation: Trend Micro FI... |
| G0077 | Leafminer | [Leafminer](https://attack.mitre.org/groups/G0077) infected victims using JavaScript code.(Citation: Symantec Leafminer July 2018) |
| G0046 | FIN7 | [FIN7](https://attack.mitre.org/groups/G0046) used JavaScript scripts to help perform tasks on the victim's machine.(Citation: FireEye FIN7 Aug 2018)(... |
| G0121 | Sidewinder | [Sidewinder](https://attack.mitre.org/groups/G0121) has used JavaScript to drop and execute malware loaders.(Citation: ATT Sidewinder January 2021)(Ci... |
| G0129 | Mustang Panda | [Mustang Panda](https://attack.mitre.org/groups/G0129) has executed a JavaScript payload utilizing wscript.exe on the endpoint.(Citation: Cisco Talos ... |
| G1052 | Contagious Interview | [Contagious Interview](https://attack.mitre.org/groups/G1052) has leveraged JavaScript in the execution of their downloader malware targeting Windows ... |
| G0126 | Higaisa | [Higaisa](https://attack.mitre.org/groups/G0126) used JavaScript to execute additional files.(Citation: Malwarebytes Higaisa 2020)(Citation: Zscaler H... |
| G1031 | Saint Bear | [Saint Bear](https://attack.mitre.org/groups/G1031) has delivered malicious Microsoft Office files containing an embedded JavaScript object that would... |
| G1019 | MoustachedBouncer | [MoustachedBouncer](https://attack.mitre.org/groups/G1019) has used JavaScript to deliver malware hosted on HTML pages.(Citation: MoustachedBouncer ES... |
| G1035 | Winter Vivern | [Winter Vivern](https://attack.mitre.org/groups/G1035) delivered malicious JavaScript to exploit targets when exploiting Roundcube Webmail servers.(Ci... |
| G0010 | Turla | [Turla](https://attack.mitre.org/groups/G0010) has used various JavaScript-based backdoors.(Citation: ESET Turla Mosquito Jan 2018) |
| G0092 | TA505 | [TA505](https://attack.mitre.org/groups/G0092) has used JavaScript for code execution.(Citation: Proofpoint TA505 Sep 2017)(Citation: Proofpoint TA505... |
| G1033 | Star Blizzard | [Star Blizzard](https://attack.mitre.org/groups/G1033) has used JavaScript to redirect victim traffic from an adversary controlled server to a server ... |
| G1038 | TA578 | [TA578](https://attack.mitre.org/groups/G1038) has used JavaScript files in malware execution chains.(Citation: Latrodectus APR 2024) |
Associated Software (42)
| ID | Name | Type | Context |
|---|---|---|---|
| S0417 | GRIFFON | Malware | [GRIFFON](https://attack.mitre.org/software/S0417) is written in and executed as [JavaScript](https://attack.mitre.org/techniques/T1059/007).(Citation... |
| S1075 | KOPILUWAK | Malware | [KOPILUWAK](https://attack.mitre.org/software/S1075) had used Javascript to perform its core functions.(Citation: Mandiant Suspected Turla Campaign Fe... |
| S9034 | Tsundere Botnet | Malware | [Tsundere Botnet](https://attack.mitre.org/software/S9034) has the ability to run JavaScript code from the C2 server. Additionally, [Tsundere Botnet](... |
| S0622 | AppleSeed | Malware | [AppleSeed](https://attack.mitre.org/software/S0622) has the ability to use JavaScript to execute PowerShell.(Citation: Malwarebytes Kimsuky June 2021... |
| S0634 | EnvyScout | Malware | [EnvyScout](https://attack.mitre.org/software/S0634) can write files to disk with JavaScript using a modified version of the open-source tool FileSave... |
| S1138 | Gootloader | Malware | [Gootloader](https://attack.mitre.org/software/S1138) can execute a Javascript file for initial infection.(Citation: Sophos Gootloader)(Citation: Sent... |
| S1249 | HexEval Loader | Malware | [HexEval Loader](https://attack.mitre.org/software/S1249) has executed malicious JavaScript code.(Citation: Socket Contagious Interview NPM April 2025... |
| S0260 | InvisiMole | Malware | [InvisiMole](https://attack.mitre.org/software/S0260) can use a JavaScript file as part of its execution chain.(Citation: ESET InvisiMole June 2020) |
| S0640 | Avaddon | Malware | [Avaddon](https://attack.mitre.org/software/S0640) has been executed through a malicious JScript downloader.(Citation: Hornet Security Avaddon June 20... |
| S1124 | SocGholish | Malware | The [SocGholish](https://attack.mitre.org/software/S1124) payload is executed as JavaScript.(Citation: SocGholish-update)(Citation: SentinelOne SocGho... |
| S0646 | SpicyOmelette | Malware | [SpicyOmelette](https://attack.mitre.org/software/S0646) has the ability to execute arbitrary JavaScript code on a compromised host.(Citation: Securew... |
| S1246 | BeaverTail | Malware | [BeaverTail](https://attack.mitre.org/software/S1246) has executed malicious JavaScript code.(Citation: Esentire ContagiousInterview BeaverTail Invisi... |
| S0673 | DarkWatchman | Malware | [DarkWatchman](https://attack.mitre.org/software/S0673) uses JavaScript to perform its core functionalities.(Citation: Prevailion DarkWatchman 2021) |
| S0341 | Xbash | Malware | [Xbash](https://attack.mitre.org/software/S0341) can execute malicious JavaScript payloads on the victim’s machine.(Citation: Unit42 Xbash Sept 2018) |
| S0228 | NanHaiShu | Malware | [NanHaiShu](https://attack.mitre.org/software/S0228) executes additional Jscript code on the victim's machine.(Citation: fsecure NanHaiShu July 2016) |
| S1160 | Latrodectus | Malware | [Latrodectus](https://attack.mitre.org/software/S1160) has used JavaScript files as part its infection chain during malicious spam email campaigns.(... |
| S0631 | Chaes | Malware | [Chaes](https://attack.mitre.org/software/S0631) has used JavaScript and Node.Js information stealer script that exfiltrates data using the node proce... |
| S0482 | Bundlore | Malware | [Bundlore](https://attack.mitre.org/software/S0482) can execute JavaScript by injecting it into the victim's browser.(Citation: MacKeeper Bundlore Apr... |
| S9010 | GlassWorm | Malware | [GlassWorm](https://attack.mitre.org/software/S9010) has leveraged JavaScript to execute its malicious code to include its hidden Unicode characters u... |
| S0455 | Metamorfo | Malware | [Metamorfo](https://attack.mitre.org/software/S0455) includes payloads written in JavaScript.(Citation: Medium Metamorfo Apr 2020) |
Related CWE Weaknesses
References
- Apple. (2016, June 13). About Mac Scripting. Retrieved April 14, 2021.
- Dominic Chell. (2021, January 1). macOS Post-Exploitation Shenanigans with VSCode Extensions. Retrieved April 20, 2021.
- Microsoft. (2007, August 15). The World of JScript, JavaScript, ECMAScript …. Retrieved June 23, 2020.
- Microsoft. (2017, January 18). Windows Script Interfaces. Retrieved June 23, 2020.
- Microsoft. (2018, May 31). Translating to JScript. Retrieved June 23, 2020.
- OpenJS Foundation. (n.d.). Node.js. Retrieved June 23, 2020.
- Phil Stokes. (2019, December 5). macOS Red Team: Calling Apple APIs Without Building Binaries. Retrieved July 17, 2020.
- Pitt, L. (2020, August 6). Persistent JXA. Retrieved April 14, 2021.
- Tony Lambert. (2021, February 18). Clipping Silver Sparrow’s wings: Outing macOS malware before it takes flight. Retrieved April 20, 2021.
Frequently Asked Questions
What is T1059.007 (JavaScript)?
T1059.007 is a MITRE ATT&CK technique named 'JavaScript'. It belongs to the Execution tactic(s). Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scri...
How can T1059.007 be detected?
Detection of T1059.007 (JavaScript) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1059.007?
There are 4 documented mitigations for T1059.007. Key mitigations include: Restrict Web-Based Content, Execution Prevention, Behavior Prevention on Endpoint, Disable or Remove Feature or Program.
Which threat groups use T1059.007?
Known threat groups using T1059.007 include: Indrik Spider, Kimsuky, TA577, Evilnum, APT32, MuddyWater, FIN6, Leafminer.