T1059.005 — Visual Basic

Tactic: Execution · Platforms: Linux, macOS, Windows

Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows technologies such as Component Object Model and the Native API through the Windows API. Although tagged as legacy with no planned future evolutions, VB…

Sub-technique of Command and Scripting Interpreter (T1059).

Sigma detection rules (3)

T1059.005 Command and Scripting Interpreter: Visual Basic

title: "T1059.005 Command and Scripting Interpreter: Visual Basic"
id: fffd8c61-84eb-4ad2-84d3-d7b2f3e983a1
description: 'Detects VBScript/VBA execution via wscript/cscript/mshta interpreters or .vbs/.vbe/.wsf script arguments. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: ParentProcess, UserContext, TimeWindow, PayloadEntropyThreshold, ModuleName.'
references:
  - https://attack.mitre.org/techniques/T1059/005
author: Shahrukh Khan
date: 2026-06-09
license: MIT
tags:
  - attack.execution
  - attack.t1059.005

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_interpreter:
    EventID: '1'
    Image|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
  selection_script_ext:
    EventID: '1'
    CommandLine|contains:
      - '.vbs'
      - '.vbe'
      - '.wsf'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: (selection_interpreter or selection_script_ext) and not filter_system_account

falsepositives:
  - Legitimate login-script or deployment VBScript usage.

level: medium

T1059.005 Command and Scripting Interpreter: Visual Basic

title: "T1059.005 Command and Scripting Interpreter: Visual Basic"
id: 90047281-87e0-4523-b5b5-4bd7ad1a4d9c
description: 'Behavioral Detection of Visual Basic Execution (VBS/VBA/VBScript) on Linux via compatibility layers. Any wine/mono invocation is not evidence of VB specifically (wine runs arbitrary Windows binaries, mono runs arbitrary .NET/C#), so detection now requires the wine/mono command line to reference a .vbs/.vba script, a VBScript engine (cscript/wscript), or the VB(.NET) compiler (vbc/vbnc) rather than bare runtime launch. T1059.005 remains a fundamentally Windows-native technique; on Linux it can only be observed indirectly through these compatibility-layer artifacts. Tune using: InterpreterPath, FileExtension, ExecContext.'
references:
  - https://attack.mitre.org/techniques/T1059/005
author: Shahrukh Khan
date: 2026-03-02
license: MIT
tags:
  - attack.execution
  - attack.t1059.005

logsource:
  category: process_creation
  product: linux

detection:
  selection_wine_vb_script:
    type: EXECVE
    a0|endswith: '/wine'
    a1|endswith:
      - '.vbs'
      - '.vba'
  selection_wine_vb_engine:
    type: EXECVE
    a0|endswith: '/wine'
    a1|contains:
      - 'cscript'
      - 'wscript'
  selection_mono_vb_compiler:
    type: EXECVE
    a0|endswith: '/mono'
    a1|contains:
      - 'vbc'
      - 'vbnc'

  condition: 1 of selection*

falsepositives:
  - Legitimate cross-platform use of Wine/Mono for non-VB Windows/.NET applications is excluded by the file-extension/interpreter checks, but a genuinely benign internal VBA/VBScript tool run through Wine would still match; scope ExecContext to unexpected source paths.

level: low

T1059.005 Command and Scripting Interpreter: Visual Basic

title: "T1059.005 Command and Scripting Interpreter: Visual Basic"
id: ba9501ba-96dd-4c3a-b4af-da3a7a723995
description: 'Behavioral Detection of Visual Basic Execution (VBS/VBA/VBScript). (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ScriptLocation, EmulationContext, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1059/005
author: Shahrukh Khan
date: 2026-01-31
license: MIT
tags:
  - attack.execution
  - attack.t1059.005

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    ParentImage|contains:
      - 'Microsoft Word'
      - 'Microsoft Excel'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/python3'
      - '/osascript'
  condition: selection and selection_child

falsepositives:
  - Legitimate VBA macro-based automation used by internal business workflows in Office documents.

level: high

Related sub-techniques

Explore