Command and Scripting Interpreter: JavaScript T1059.007

Events covered

16 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 70 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (64 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

Top indicator values (835 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

Exclusions (154 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 23 rules

• Adwind RAT / JRAT
• Adwind RAT / JRAT File Artifact
• AppLocker Prevented Application or Script from Running
• Csc.EXE Execution Form Potentially Suspicious Parent
• Cscript/Wscript Uncommon Script Extension Execution
• HackTool - CACTUSTORCH Remote Thread Creation
• HackTool - Koadic Execution
• HTML Help HH.EXE Suspicious Child Process
• JXA In-memory Execution Via OSAScript
• MSHTA Execution with Suspicious File Extensions
• Node Process Executions
• NodeJS Execution of JavaScript File
• Potential Dropper Script Execution Via WScript/CScript/MSHTA
• Potential In-Memory Download And Compile Of Payloads
• Potential Remote SquiblyTwo Technique Execution
• Potentially Suspicious Inline JavaScript Execution via NodeJS Binary
• Script Interpreter Spawning Credential Scanner - Windows
• Suspicious Deno File Written from Remote Source
• Suspicious HH.EXE Execution
• Suspicious Installer Package Child Process
• WScript or CScript Dropper - File
• WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
• XSL Script Execution Via WMIC.EXE

Elastic 35 rules

• Anomalous React Server Components Flight Data Patterns
• Command and Scripting Interpreter via Windows Scripts
• Deprecated - Unusual Process Spawned from Web Server Parent
• Execution of a Downloaded Windows Script
• Execution via Electron Child Process Node.js Module
• Execution via GitHub Actions Runner
• Execution via OpenClaw Agent
• Google Calendar C2 via Script Interpreter
• Long Base64 Encoded Command via Scripting Interpreter
• Microsoft Build Engine Started by a Script Process
• Microsoft Management Console File from Unusual Path
• Node.js Pre or Post-Install Script Execution
• Potential Etherhiding C2 via Blockchain Connection
• Potential JAVA/JNDI Exploitation Attempt
• Potential SAP NetWeaver Exploitation
• Potential SAP NetWeaver WebShell Creation
• React2Shell (CVE-2025-55182) Exploitation Attempt
• React2Shell Network Security Alert
• Remote File Download via Script Interpreter
• Remote XSL Script Execution via COM
• Script Execution via Microsoft HTML Application
• Script Interpreter Connection to Non-Standard Port
• Suspicious .NET Code Compilation
• Suspicious Automator Workflows Execution
• Suspicious AWS S3 Connection via Script Interpreter
• Suspicious Curl to Jamf Endpoint
• Suspicious Execution from VS Code Extension
• Suspicious Execution with NodeJS
• Suspicious Installer Package Spawns Network Event
• Suspicious JavaScript Execution via Deno
• Suspicious React Server Child Process
• Web Shell Detection: Script Process Child of Common Web Processes
• Windows Script Executing PowerShell
• Windows Script Execution from Archive
• Windows Script Interpreter Executing Process via WMI

Splunk 11 rules

• Executable Process from Suspicious Folder (PowerShell)
• Executable Process from Suspicious Folder (Sysmon)
• Executable Process from Suspicious Folder (Windows Event Log)
• Jscript Execution Using Cscript App
• MS Scripting Process Loading Ldap Module
• MS Scripting Process Loading WMI Module
• Windows Cmdline Tool Execution From Non-Shell Process
• Windows GrimResource - MMC Process Accessing APDS DLL
• Wscript_Cscript Execution (PowerShell)
• Wscript_Cscript Execution (Sysmon)
• Wscript_Cscript Execution (Windows Event Log)

Kusto 1 rule

• Script Interpreter Loading DotNet Assembly From Memory