T1059.007 — JavaScript

Tactic: Execution · Platforms: Linux, macOS, Windows

Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser. JScript is…

Sub-technique of Command and Scripting Interpreter (T1059).

Sigma detection rules (3)

T1059.007 Command and Scripting Interpreter: JavaScript

title: "T1059.007 Command and Scripting Interpreter: JavaScript"
id: 6a8b9a01-d963-42b5-a60b-cf7594b8ff66
description: 'Cross-platform detection of JavaScript execution abuse, requiring wscript/cscript invoked with a .js/.jse argument or mshta invoking a javascript: URI, launched from common phishing-delivery parents. Tune using: ParentProcess, ScriptPath, TimeWindow, UserContext, EntropyScore.'
references:
  - https://attack.mitre.org/techniques/T1059/007
author: Shahrukh Khan
date: 2026-01-08
license: MIT
tags:
  - attack.execution
  - attack.t1059.007

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_js_host:
    Image|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
    CommandLine|contains:
      - '.js'
      - '.jse'

  selection_mshta_js:
    Image|endswith: '\mshta.exe'
    CommandLine|contains: 'javascript:'

  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\outlook.exe'
      - '\iexplore.exe'

  condition: (selection_js_host or selection_mshta_js) and selection_parent

falsepositives:
  - Legitimate JScript automation (.js/.jse) or mshta javascript: usage deployed via login scripts or line-of-business applications launched from these same parents.

level: high

T1059.007 Command and Scripting Interpreter: JavaScript

title: "T1059.007 Command and Scripting Interpreter: JavaScript"
id: f1a7a94a-2feb-4536-a2df-eac5c207aef6
description: 'Cross-Platform Detection of JavaScript Execution Abuse. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ScriptPath, BinaryName, UserExecutionContext, NetworkFollowUp.'
references:
  - https://attack.mitre.org/techniques/T1059/007
author: Shahrukh Khan
date: 2026-05-30
license: MIT
tags:
  - attack.execution
  - attack.t1059.007

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/node'
      - '/nodejs'
    a1: '-e'
  condition: selection

falsepositives:
  - Legitimate Node.js developers and CI/CD pipelines routinely use node -e for quick script execution and testing.

level: medium

T1059.007 Command and Scripting Interpreter: JavaScript

title: "T1059.007 Command and Scripting Interpreter: JavaScript"
id: aef47d20-7279-4c20-b70d-7e3da4f3bfc2
description: 'Cross-Platform Detection of JavaScript Execution Abuse. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ScriptLocation, ParentProcess, APIInvocation.'
references:
  - https://attack.mitre.org/techniques/T1059/007
author: Shahrukh Khan
date: 2026-01-13
license: MIT
tags:
  - attack.execution
  - attack.t1059.007

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/osascript'
    CommandLine|contains: '-l JavaScript'
  condition: selection

falsepositives:
  - Legitimate JXA (JavaScript for Automation) scripts used by system administrators for Mac automation.

level: high

Related sub-techniques

Explore