MITRE ATT&CKsub-technique

T1059.005 Visual Basic

Published 2020-03-09 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Execution
Platforms
Linux, macOS, Windows
Version
1.5
Created
2020-03-09

Description

Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows technologies such as Component Object Model and the Native API through the Windows API. Although tagged as legacy with no planned future evolutions, VB is integrated and supported in the .NET Framework and cross-platform .NET Core. Derivative languages based on VB have also been created, such as Visual Basic for Applications (VBA) and VBScript. VBA is an event-driven programming language built into Microsoft Office, as well as several third-party applications. VBA enables documents to contain macros used to automate the execution of tasks and other functionality on the host. VBScript is a default scripting language on Windows hosts and can also be used in place of JavaScript on HTML Application (HTA) webpages served to Internet Explorer (though most modern browsers do not come with VBScript support). Adversaries may use VB payloads to execute malicious commands. Common malicious usage includes automating execution of behaviors with VBScript or embedding VBA content into Spearphishing Attachment payloads (which may also involve Mark-of-the-Web Bypass to enable execution).

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1059 Command and Scripting Interpreter technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (5)

  • M1038 Execution Prevention mitigation
  • M1040 Behavior Prevention on Endpoint mitigation
  • M1042 Disable or Remove Feature or Program mitigation
  • M1049 Antivirus/Antimalware mitigation
  • M1021 Restrict Web-Based Content mitigation

Referenced by MITRE ATT&CK · uses (131)

  • C0060 Operation AkaiRyū campaign
  • G1054 MirrorFace group
  • S9001 SystemBC software (malware)
  • G1052 Contagious Interview group
  • G1044 APT42 group
  • S1193 TAMECAT software (malware)
  • S1178 ShrinkLocker software (malware)
  • C0044 Juicy Mix campaign
  • C0042 Outer Space campaign
  • G1039 RedCurl group
  • S1149 CHIMNEYSWEEP software (malware)
  • S1142 LunarMail software (malware)
  • S1132 IPsec Helper software (malware)
  • G1026 Malteiro group
  • S1122 Mispadu software (malware)
  • S1111 DarkGate software (malware)
  • C0028 2015 Ukraine Electric Power Attack campaign
  • S1086 Snip3 software (malware)
  • G1018 TA2541 group
  • G1016 FIN13 group
  • C0025 2016 Ukraine Electric Power Attack campaign
  • C0024 SolarWinds Compromise campaign
  • C0022 Operation Dream Job campaign
  • S1064 SVCReady software (malware)
  • C0015 C0015 campaign
  • C0016 Operation Dust Storm campaign
  • C0014 Operation Wocao campaign
  • C0013 Operation Sharpshooter campaign
  • C0011 C0011 campaign
  • C0012 Operation CuckooBees campaign
Show all 131 ›

Referenced by Compliance · mitigates (23)

  • CIS-10.1 Deploy and Maintain Anti-Malware Software CIS Safeguard v8.1
  • CIS-10.7 Use Behavior-Based Anti-Malware Software CIS Safeguard v8.1
  • CIS-13.7 Deploy a Host-Based Intrusion Prevention Solution CIS Safeguard v8.1
  • CIS-2.7 Allowlist Authorized Scripts CIS Safeguard v8.1
  • CIS-9.6 Block Unnecessary File Types CIS Safeguard v8.1
  • CIS-9.7 Deploy and Maintain Email Server Anti-Malware Protections CIS Safeguard v8.1
  • NIST-AC-17 Remote Access NIST 800-53 control
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-CM-8 System Component Inventory NIST 800-53 control
  • NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
  • NIST-SC-18 Mobile Code NIST 800-53 control
  • NIST-SI-10 Information Input Validation NIST 800-53 control
  • NIST-SI-16 Memory Protection NIST 800-53 control
  • NIST-SI-2 Flaw Remediation NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References