The Attenuator acts as an intelligent filter that can analyze security events detected by Jibril and provide additional context.
New Feature!
Jibril
Jibril eBPF and Security DiscordGarnet Labs🐈‍⬛
  • Jibril
    • Jibril
      • New Era
      • Theory Behind
      • Architecture
      • Agent Dashboard
      • Compare
    • Install and Run
      • Requirements
      • Systemd Service
      • Command Line
      • Docker Container
      • Kubernetes
        • Kubernetes Script
      • Configuration File
      • Network Policy File
      • Systemd Config
    • Components
      • Features
      • Extensions
      • Plugins
      • Printers
      • Events
      • Network Policy
      • Attenuator
    • Mechanisms
      • File Access
      • Execution
      • File Access And Execution
      • Network Peers
      • Network eBPF Logic
      • Probes and Traces
      • Bigger eBPF Logic
      • Loader Interception
    • Detections
      • File Access
        • Auth Logs Tamper
        • Binary Self Deletion
        • Capabilities Modification
        • Code Modification Through Procfs
        • Core Pattern Access
        • CPU Fingerprint
        • Credentials Files Access
        • Crypto Miner Files
        • Environment Read From ProcFS
        • File Example
        • Filesystem Fingerprint
        • Global Shlib Modification
        • Java Debug Lib Load
        • Java Instrument Lib Load
        • Machine Fingerprint
        • OS Fingerprint
        • OS Network Fingerprint
        • OS Status Fingerprint
        • Package Repo Config Modification
        • PAM Config Modification
        • Sched Debug Access
        • Shell Config Modification
        • SSL Certificate Access
        • Sudoers Modification
        • Sysrq Access
        • Unprivileged Bpf Config Access
      • Execution
        • Binary Executed By Loader
        • Code On The Fly
        • Crypto Miner Execution
        • Data Encoder Exec
        • Denial Of Service Tools
        • Exec Example
        • Exec From Unusual Dir
        • File Attribute Change
        • Hidden Elf Exec
        • Interpreter Shell Spawn
        • Net Filecopy Tool Exec
        • Net MitM Tool Exec
        • Net Scan Tool Exec
        • Net Sniff Tool Exec
        • Net Suspicious Tool Exec
        • Net Suspicious Tool Shell
        • Passwd Usage
        • Runc Suspicious Exec
        • Webserver Exec
        • Webserver Shell Exec
      • Network Peers
        • Adult Domain Access
        • Badware Domain Access
        • Dynamic DNS Domain Access
        • Fake Domain Access
        • Gambling Domain Access
        • Peer Example
        • Piracy Domain Access
        • Plaintext Communication
        • Threat Domain Access
        • Tracking Domain Access
        • VPN Domain Access
    • Bugs and Requests
    • Banner
    • License
  • MITRE
    • Techniques
      • Reconnaissance
        • Active Scanning
          • Scanning IP Blocks
          • Vulnerability Scanning
          • Wordlist Scanning
        • Gather Victim Host Information
          • Hardware
          • Software
          • Firmware
          • Client Configurations
        • Gather Victim Identity Information
          • Credentials
          • Email Addresses
          • Employee Names
        • Gather Victim Network Information
          • Domain Properties
          • DNS
          • Network Trust Dependencies
          • Network Topology
          • IP Addresses
          • Network Security Appliances
        • Gather Victim Org Information
          • Determine Physical Locations
          • Business Relationships
          • Identify Business Tempo
          • Identify Roles
        • Phishing for Information
          • Spearphishing Service
          • Spearphishing Attachment
          • Spearphishing Link
          • Spearphishing Voice
        • Search Closed Sources
          • Threat Intel Vendors
          • Purchase Technical Data
        • Search Open Technical Databases
          • DNS/Passive DNS
          • WHOIS
          • Digital Certificates
          • CDNs
          • Scan Databases
        • Search Open Websites/Domains
          • Social Media
          • Search Engines
          • Code Repositories
        • Search Victim-Owned Websites
      • Resource Development
        • Acquire Access
        • Acquire Infrastructure
          • Domains
          • DNS Server
          • Virtual Private Server
          • Server
          • Botnet
          • Web Services
          • Serverless
          • Malvertising
        • Compromise Accounts
          • Social Media Accounts
          • Email Accounts
          • Cloud Accounts
        • Compromise Infrastructure
          • Domains
          • DNS Server
          • Virtual Private Server
          • Server
          • Botnet
          • Web Services
          • Serverless
          • Network Devices
        • Develop Capabilities
          • Malware
          • Code Signing Certificates
          • Digital Certificates
          • Exploits
        • Establish Accounts
          • Social Media Accounts
          • Email Accounts
          • Cloud Accounts
        • Obtain Capabilities
          • Malware
          • Tool
          • Code Signing Certificates
          • Digital Certificates
          • Exploits
          • Vulnerabilities
          • Artificial Intelligence
        • Stage Capabilities
          • Upload Malware
          • Upload Tool
          • Install Digital Certificate
          • Drive-by Target
          • Link Target
          • SEO Poisoning
      • Initial Access
        • Drive-by Compromise
        • Exploit Public-Facing Application
        • External Remote Services
        • Hardware Additions
        • Phishing
          • Spearphishing Attachment
          • Spearphishing Link
          • Spearphishing via Service
          • Spearphishing Voice
        • Replication Through Removable Media
        • Supply Chain Compromise
          • Compromise Software Dependencies and Development Tools
          • Compromise Software Supply Chain
          • Compromise Hardware Supply Chain
        • Trusted Relationship
        • Valid Accounts
          • Default Accounts
          • Domain Accounts
          • Local Accounts
          • Cloud Accounts
      • Execution
        • Cloud Administration Command
        • Command and Scripting Interpreter
          • PowerShell
          • AppleScript
          • Windows Command Shell
          • Unix Shell
          • Visual Basic
          • Python
          • JavaScript
          • Network Device CLI
          • Cloud API
          • AutoHotkey & AutoIt
          • Lua
        • Container Administration Command
          • Deploy Container
        • Exploitation for Client Execution
        • Inter-Process Communication
          • Component Object Model
          • Dynamic Data Exchange
          • XPC Services
        • Native API
        • Scheduled Task/Job
          • At
          • Cron
          • Scheduled Task
          • Systemd Timers
          • Container Orchestration Job
        • Serverless Execution
        • Shared Modules
        • Software Deployment Tools
        • System Services
          • Launchctl
          • Service Execution
        • User Execution
          • Malicious Link
          • Malicious File
          • Malicious Image
        • Windows Management Instrumentation
      • Persistence
        • Account Manipulation
          • Additional Cloud Credentials
          • Additional Email Delegate Permissions
          • Additional Cloud Roles
          • SSH Authorized Keys
          • Device Registration
          • Additional Container Cluster Roles
          • Additional Local or Domain Groups
        • BITS Jobs
        • Boot or Logon Autostart Execution
          • Registry Run Keys / Startup Folder
          • Authentication Package
          • Time Providers
          • Winlogon Helper DLL
          • Security Support Provider
          • Kernel Modules and Extensions
          • Re-opened Applications
          • LSASS Driver
          • Shortcut Modification
          • Port Monitors
          • Print Processors
          • XDG Autostart Entries
          • Active Setup
          • Login Items
        • Boot or Logon Initialization Scripts
          • Logon Script (Windows)
          • Login Hook
          • Network Logon Script
          • RC Scripts
          • Startup Items
        • Browser Extensions
        • Compromise Host Software Binary
        • Create Account
          • Local Account
          • Domain Account
          • Cloud Account
        • Create or Modify System Process
          • Launch Agent
          • Systemd Service
          • Windows Service
          • Launch Daemon
          • Container Service
        • Event Triggered Execution
          • Change Default File Association
          • Screensaver
          • Windows Management Instrumentation Event Subscription
          • Unix Shell Configuration Modification
          • Trap
          • LC_LOAD_DYLIB Addition
          • Netsh Helper DLL
          • Accessibility Features
          • AppCert DLLs
          • AppInit DLLs
          • Application Shimming
          • Image File Execution Options Injection
          • PowerShell Profile
          • Emond
          • Component Object Model Hijacking
          • Installer Packages
          • Udev Rules
        • External Remote Services
        • Hijack Execution Flow
          • DLL Search Order Hijacking
          • DLL Side-Loading
          • Dylib Hijacking
          • Executable Installer File Permissions Weakness
          • Dynamic Linker Hijacking
          • Path Interception by PATH Environment Variable
          • Path Interception by Search Order Hijacking
          • Path Interception by Unquoted Path
          • Services File Permissions Weakness
          • Services Registry Permissions Weakness
          • COR_PROFILER
          • KernelCallbackTable
          • AppDomainManager
        • Implant Internal Image
        • Modify Authentication Process
          • Domain Controller Authentication
          • Password Filter DLL
          • Pluggable Authentication Modules
          • Network Device Authentication
          • Reverse Encryption
          • Multi-Factor Authentication
          • Hybrid Identity
          • Network Provider DLL
          • Conditional Access Policies
        • Office Application Startup
          • Office Template Macros
          • Office Test
          • Outlook Forms
          • Outlook Home Page
          • Outlook Rules
          • Add-ins
        • Pre-OS Boot
          • System Firmware
          • Component Firmware
          • Bootkit
          • ROMMONkit
          • TFTP Boot
        • Scheduled Task/Job
        • Server Software Component
          • SQL Stored Procedures
          • Transport Agent
          • Web Shell
          • IIS Components
          • Terminal Services DLL
        • Traffic Signaling
          • Port Knocking
          • Socket Filters
        • Valid Accounts
      • Privilege Escalation
        • Abuse Elevation Control Mechanism
          • Setuid and Setgid
          • Bypass User Account Control
          • Sudo and Sudo Caching
          • Elevated Execution with Prompt
          • Temporary Elevated Cloud Access
          • TCC Manipulation
        • Access Token Manipulation
          • Token Impersonation/Theft
          • Create Process with Token
          • Make and Impersonate Token
          • Parent PID Spoofing
          • SID-History Injection
        • Account Manipulation
        • Boot or Logon Autostart Execution
        • Boot or Logon Initialization Scripts
        • Create or Modify System Process
        • Domain or Group Policy Modification
          • Group Policy Modification
          • Trust Modification
        • Escape to Host
        • Event Triggered Execution
        • Exploitation for Privilege Escalation
        • Hijack Execution Flow
        • Process Injection
          • Dynamic-link Library Injection
          • Portable Executable Injection
          • Thread Execution Hijacking
          • Asynchronous Procedure Call
          • Thread Local Storage
          • Ptrace System Calls
          • Proc Memory
          • Extra Window Memory Injection
          • Process Hollowing
          • Process Doppelgänging
          • VDSO Hijacking
          • ListPlanting
        • Scheduled Task/Job
        • Valid Accounts
      • Defense Evasion
        • Abuse Elevation Control Mechanism
        • Access Token Manipulation
        • BITS Jobs
        • Build Image on Host
        • Deobfuscate/Decode Files or Information
        • Direct Volume Access
        • Domain Policy Modification
        • Execution Guardrails
          • Environmental Keying
          • Geofencing
          • Time Based Evasion
        • Exploitation for Defense Evasion
        • File and Directory Permissions Modification
          • Windows File and Directory Permissions Modification
          • Linux and Mac File and Directory Permissions Modification
        • Hide Artifacts
          • Hidden Files and Directories
          • Hidden Users
          • Hidden Window
          • NTFS File Attributes
          • Hidden File System
        • Hijack Execution Flow
        • Impair Defenses
          • Disable or Modify Tools
          • Disable Windows Event Logging
          • Disable or Modify System Firewall
          • Disable or Modify Cloud Logs
        • Indicator Removal
          • Clear Windows Event Logs
          • Clear Command History
          • Clear Network Connection History and Logs
          • File Deletion
          • Timestomp
        • Indirect Command Execution
        • Masquerading
          • Match Legitimate Name or Location
          • Rename System Utilities
          • Masquerade Task or Service
          • Double File Extension
          • Right-to-Left Override
          • Space after Filename
          • Compiled HTML File
        • Modify Authentication Process
        • Modify Cloud Environment
          • Add Resources or Services
          • Modify Permissions
        • Modify Registry
        • Modify System Image
          • Patch System Image
          • Downgrade System Image
        • Network Boundary Bridging
          • Network Address Translation Traversal
        • Obfuscated Files or Information
          • Software Packing
          • Steganography
          • Compile After Delivery
          • Binary Padding
          • HTML Smuggling
        • Pre-OS Boot
        • Process Injection
        • Reflective Code Loading
        • Rogue Domain Controller
        • Rootkit
        • Subvert Trust Controls
          • Mark-of-the-Web Bypass
          • SIP and Trust Provider Hijacking
          • Code Signing
          • Install Root Certificate
          • Gatekeeper Bypass
        • System Binary Proxy Execution
          • Compiled HTML File
          • Control Panel
          • CMSTP
          • InstallUtil
          • Mshta
          • Msiexec
          • Odbcconf
          • Regsvcs/Regasm
          • Regsvr32
          • Rundll32
          • Verclsid
          • Mavinject
          • MMC
        • System Script Proxy Execution
          • PubPrn
        • Template Injection
        • Traffic Signaling
        • Use Alternate Authentication Material
          • Application Access Token
          • Pass the Hash
          • Pass the Ticket
          • Web Session Cookie
        • Valid Accounts
        • Virtualization/Sandbox Evasion
          • System Checks
          • User Activity Based Checks
          • Time Based Evasion
        • Weaken Encryption
          • Reduce Key Space
          • Disable or Remove Encryption
        • XSL Script Processing
        • Credential Access
          • Adversary-in-the-Middle
            • LLMNR/NBT-NS Poisoning and SMB Relay
            • ARP Cache Poisoning
            • DHCP Spoofing
            • Evil Twin
          • Brute Force
            • Password Guessing
            • Password Cracking
            • Password Spraying
            • Credential Stuffing
          • Credentials from Password Stores
            • Credentials from Web Browsers
            • Windows Credential Manager
            • Credentials from Password Managers
          • Exploitation for Credential Access
          • Forced Authentication
          • Forge Web Credentials
            • Web Cookies
            • SAML Tokens
          • Input Capture
            • Keylogging
            • GUI Input Capture
            • Web Portal Capture
          • Modify Authentication Process
          • Multi-Factor Authentication Interception
          • Multi-Factor Authentication Request Generation
          • Network Sniffing
          • OS Credential Dumping
            • LSASS Memory
            • Security Account Manager
            • NTDS
            • LSA Secrets
            • Cached Domain Credentials
            • DCSync
            • Proc Filesystem
          • Steal Application Access Token
          • Steal or Forge Authentication Certificates
          • Steal or Forge Kerberos Tickets
            • Golden Ticket
            • Silver Ticket
            • Kerberoasting
          • Steal Web Session Cookie
          • Unsecured Credentials
            • Credentials in Files
            • Credentials in Registry
            • Bash History
            • Credentials in Configuration Files
        • Discovery
          • Account Discovery
            • Local Account
            • Domain Account
            • Cloud Account
          • Application Window Discovery
          • Browser Bookmark Discovery
          • Cloud Infrastructure Discovery
            • Cloud Storage Object Discovery
          • Cloud Service Dashboard
          • Cloud Service Discovery
          • Container and Resource Discovery
          • Domain Trust Discovery
          • File and Directory Discovery
          • Group Policy Discovery
          • Network Service Discovery
          • Network Share Discovery
          • Network Sniffing
          • Password Policy Discovery
          • Peripheral Device Discovery
          • Permission Groups Discovery
            • Local Groups
            • Domain Groups
            • Cloud Groups
          • Process Discovery
          • Query Registry
          • Remote System Discovery
          • Software Discovery
            • Security Software Discovery
            • Installed Services Discovery
          • System Information Discovery
          • System Location Discovery
            • System Language Discovery
          • System Network Configuration Discovery
            • Internet Connection Discovery
            • Domain Generation Algorithm Discovery
          • System Network Connections Discovery
          • System Owner/User Discovery
          • System Service Discovery
          • System Time Discovery
          • Virtualization/Sandbox Evasion
          • Wireless Network Discovery
        • Lateral Movement
          • Exploitation of Remote Services
          • Internal Spearphishing
          • Lateral Tool Transfer
          • Remote Service Session Hijacking
            • RDP Hijacking
          • Remote Services
            • Remote Desktop Protocol
            • Windows Admin Shares
            • Distributed Component Object Model
            • SSH
            • VNC
            • Apple Remote Desktop
            • Cloud Services
          • Replication Through Removable Media
          • Software Deployment Tools
          • Taint Shared Content
          • Use Alternate Authentication Material
        • Collection
          • Adversary-in-the-Middle
          • Archive Collected Data
            • Archive via Utility
            • Archive via Library
            • Archive via Custom Method
          • Audio Capture
          • Automated Collection
          • Browser Session Hijacking
          • Clipboard Data
          • Data from Cloud Storage
            • Cloud Storage Object
          • Data from Configuration Repository
            • SNMP MIB Dump
            • Network Device Configuration Dump
          • Data from Information Repositories
            • SharePoint
            • Code Repositories
            • Customer Relationship Management Software
            • Messaging Applications
          • Data from Local System
          • Data from Network Shared Drive
          • Data from Removable Media
          • Data Staged
            • Local Data Staging
            • Remote Data Staging
          • Email Collection
            • Local Email Collection
            • Remote Email Collection
            • Email Forwarding Rule
          • Input Capture
          • Screen Capture
          • Video Capture
        • Command and Control
          • Application Layer Protocol
            • Web Protocols
            • File Transfer Protocols
            • Mail Protocols
            • DNS
          • Communication Through Removable Media
          • Data Encoding
            • Standard Encoding
            • Non-Standard Encoding
          • Data Obfuscation
            • Junk Data
            • Steganography
            • Protocol Impersonation
          • Dynamic Resolution
            • Fast Flux DNS
            • Domain Generation Algorithms
            • DNS Calculation
          • Encrypted Channel
            • Symmetric Cryptography
            • Asymmetric Cryptography
          • Fallback Channels
          • Ingress Tool Transfer
          • Multi-Stage Channels
          • Non-Application Layer Protocol
          • Non-Standard Port
          • Protocol Tunneling
          • Proxy
            • Internal Proxy
            • External Proxy
            • Multi-hop Proxy
            • Domain Fronting
          • Remote Access Software
          • Traffic Signaling
          • Web Service
            • Dead Drop Resolver
            • Bidirectional Communication
            • One-Way Communication
        • Exfiltration
          • Automated Exfiltration
            • Traffic Duplication
          • Data Transfer Size Limits
          • Exfiltration Over Alternative Protocol
            • Exfiltration Over Symmetric Encrypted Non-C2 Protocol
            • Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
            • Exfiltration Over Unencrypted Non-C2 Protocol
          • Exfiltration Over C2 Channel
          • Exfiltration Over Other Network Medium
            • Exfiltration Over Bluetooth
          • Exfiltration Over Physical Medium
            • Exfiltration over USB
          • Exfiltration Over Web Service
            • Exfiltration to Cloud Storage
            • Exfiltration to Code Repository
            • Exfiltration to Text Storage Sites
            • Exfiltration Over Webhook
          • Scheduled Transfer
        • Impact
          • Account Access Removal
          • Data Destruction
            • Lifecycle/Trigger Deletion
          • Data Encrypted for Impact
          • Data Manipulation
            • Stored Data Manipulation
            • Transmitted Data Manipulation
            • Runtime Data Manipulation
          • Defacement
            • Internal Defacement
            • External Defacement
          • Disk Wipe
            • Disk Structure Wipe
            • Disk Content Wipe
          • Endpoint Denial of Service
            • OS Exhaustion Flood
            • Service Exhaustion Flood
            • Application Exhaustion Flood
            • Application or System Exploitation
          • Firmware Corruption
          • Inhibit System Recovery
          • Network Denial of Service
            • Direct Network Flood
            • Reflection Amplification
          • Resource Hijacking
            • SMS Pumping
          • Service Stop
          • System Shutdown/Reboot
  • Knowledge
    • eBPF
      • eBPF Helpers
        • map_xxx_elem (v3.19)
        • get_prandom_u32 (v4.1)
        • get_smp_processor_id (v4.1)
  • Research
    • Runtime Security
      • Valkyrie Response
Powered by GitBook

© 2025 • Jibril • by Garnet Labs

On this page
  • Information
  • Introduction
  • Deep Dive Into Technique
  • When this Technique is Usually Used
  • How this Technique is Usually Detected
  • Why it is Important to Detect This Technique
  • Examples
  1. MITRE
  2. Techniques
  3. Execution
  4. Command and Scripting Interpreter

Visual Basic

Visual Basic [T1059.005]

Last updated 1 month ago

Information

  • Name: Visual Basic

  • ID: T1059.005

  • Tactics:

  • Technique:

Introduction

Visual Basic (VB) scripting, identified as sub-technique T1059.005 in the MITRE ATT&CK framework, refers to adversaries employing VB scripts to execute malicious commands or payloads on targeted systems. Visual Basic scripts are commonly used due to their native support on Windows systems, ease of use, and capability to interact seamlessly with various Windows components. Attackers leverage VB scripts to automate execution, evade detection, and perform various malicious activities, including persistence, lateral movement, and command-and-control (C2) communication.

Deep Dive Into Technique

Visual Basic scripts (VBS) are plain-text scripts executed by the Windows Script Host (WSH) environment, which includes tools such as wscript.exe and cscript.exe. Attackers exploit these built-in Windows utilities to execute malicious scripts without invoking external binaries, thus reducing suspicion.

Technical details include:

  • Execution Methods:

    • Direct invocation using wscript.exe or cscript.exe from command-line or batch scripts.

    • Embedding VB scripts within Office documents (macros) to execute malicious payloads upon user interaction.

    • Utilizing scripts stored in registry keys or scheduled tasks to establish persistence.

  • Common Mechanisms:

    • Leveraging VB scripts for reconnaissance, such as enumerating system information, network shares, and installed software.

    • Downloading additional payloads from remote servers using built-in objects like XMLHTTP or WinHttpRequest.

    • Encoding or obfuscating scripts (e.g., Base64 encoding, string concatenation, character substitution) to evade signature-based detection mechanisms.

    • Using COM objects for direct interaction with Windows APIs, enabling attackers to manipulate system settings, execute commands, or manage processes.

  • Real-world Procedures:

    • Attackers frequently embed malicious VB scripts within phishing emails or compromised websites, enticing users to execute malicious macros or scripts.

    • Malicious scripts are often deployed in targeted attacks via spear-phishing campaigns, exploiting user trust and lack of security awareness.

    • Advanced persistent threat (APT) actors utilize VB scripts for stealthy execution and persistence due to their low detection profile and native Windows integration.

When this Technique is Usually Used

Attack scenarios and stages where Visual Basic scripting is commonly utilized include:

  • Initial Access and Delivery:

    • Malicious email attachments (e.g., Office documents with embedded VB macros).

    • Drive-by downloads from compromised websites.

  • Execution and Persistence:

    • Establishing persistent footholds through scheduled tasks or registry modifications.

    • Automating execution of secondary payloads after initial compromise.

  • Defense Evasion:

    • Using obfuscated or encoded VB scripts to avoid detection by antivirus and endpoint detection and response (EDR) solutions.

    • Leveraging legitimate Windows scripting hosts (wscript.exe, cscript.exe) to blend with normal system behavior.

  • Lateral Movement and Privilege Escalation:

    • Executing VB scripts remotely via Windows Management Instrumentation (WMI) or PowerShell remoting.

    • Utilizing scripts to exploit vulnerabilities or misconfigurations to escalate privileges or move laterally within the network.

  • Command-and-Control (C2):

    • Establishing communication channels with attacker-controlled servers using HTTP/HTTPS requests via VB scripts.

    • Periodically polling remote servers for commands or exfiltrating data through encoded HTTP requests.

How this Technique is Usually Detected

Detection methods and tools commonly employed to identify malicious Visual Basic scripting include:

  • Endpoint Detection and Response (EDR) Solutions:

    • Monitoring execution of wscript.exe and cscript.exe processes, especially when invoked from unusual locations or with uncommon command-line parameters.

    • Detecting anomalous script execution patterns, such as frequent or unusual script file extensions (.vbs, .vbe).

  • Behavioral Analysis:

    • Identifying suspicious behaviors, including scripts downloading files from unknown external sources or executing encoded commands.

    • Observing scripts modifying registry keys, creating scheduled tasks, or interacting with COM objects in unusual ways.

  • Process Monitoring and Logging:

    • Collecting and analyzing Windows Event Logs, Sysmon logs, and process execution logs for unusual script execution.

    • Tracking command-line arguments passed to scripting hosts to detect encoded or obfuscated payloads.

  • Network Monitoring:

    • Detecting outbound HTTP/HTTPS requests initiated by VB scripts to unknown or suspicious domains.

    • Monitoring unusual traffic patterns indicative of C2 communication or data exfiltration attempts.

  • Specific Indicators of Compromise (IoCs):

    • Presence of unusual VB script files in temporary directories or user profile folders.

    • Registry modifications or scheduled tasks associated with script execution.

    • Known malicious script content or signatures identified through file analysis or threat intelligence feeds.

Why it is Important to Detect This Technique

Detecting malicious Visual Basic scripting is critical due to its potential impact on systems and networks:

  • System Compromise and Data Breach:

    • Attackers can use VB scripts to download and execute secondary payloads, leading to full system compromise or sensitive data exfiltration.

  • Persistence and Long-term Access:

    • Malicious scripts can establish persistent footholds, allowing attackers to maintain long-term access and control over compromised systems.

  • Difficulty in Attribution and Detection:

    • VB scripts executed via legitimate Windows utilities may evade traditional antivirus detection, complicating incident response and attribution.

  • Privilege Escalation and Lateral Movement:

    • Attackers can leverage scripts to escalate privileges or move laterally within networks, potentially compromising critical infrastructure or sensitive resources.

  • Early Detection and Mitigation:

    • Prompt identification and response to malicious VB script execution can significantly reduce the scope and impact of security incidents.

    • Early detection prevents attackers from establishing persistence or escalating privileges, limiting overall damage and remediation costs.

Examples

Real-world examples demonstrating the use of malicious Visual Basic scripting include:

  • Emotet Malware Campaign:

    • Attackers distributed malicious Microsoft Word documents containing VB macros via phishing emails.

    • Upon execution, macros downloaded and executed the Emotet banking trojan, leading to credential theft and further malware infections.

  • TrickBot Banking Trojan:

    • VB scripts embedded within malicious Excel documents executed upon enabling macros, downloading TrickBot payloads from remote servers.

    • Attackers utilized TrickBot to steal banking credentials, execute ransomware, and enable lateral movement across compromised networks.

  • APT32 (OceanLotus) Campaign:

    • Targeted attacks leveraged VB scripts embedded in Office documents to execute payloads silently.

    • Scripts performed reconnaissance, downloaded additional malware, and established persistent backdoors for espionage activities.

  • FIN7 Financially Motivated Attacks:

    • Attackers utilized VB scripts within spear-phishing emails targeting retail and hospitality sectors.

    • Scripts executed PowerShell commands, downloaded payloads, and facilitated lateral movement, resulting in significant financial losses.

  • QakBot (Qbot) Malware:

    • Malicious VB scripts embedded in phishing emails executed payloads that downloaded QakBot malware.

    • QakBot facilitated credential theft, lateral movement, and ransomware deployment, causing substantial operational disruptions.

These examples highlight the versatility of Visual Basic scripting as a tool leveraged by threat actors across various attack scenarios, emphasizing the importance of robust detection and mitigation strategies.

TA0002
T1059