Command and Scripting Interpreter

What is Command and Scripting Interpreter?

“Command and Scripting Interpreter is documented as technique T1059 in MITRE ATT&CK® v19.1 under the Execution tactic. Detection requires visibility into XDR, SIEM telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Command and Scripting Interpreter activity. These methods apply across XDR, SIEM environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Enable PowerShell script block logging and module logging to capture the full decoded content of executed scripts, including deobfuscated payloads that may not be visible in process command line arguments alone.

2. 2

   Monitor for command interpreter processes spawned by unusual parent processes such as Microsoft Office applications, web browsers, email clients, or PDF readers, which strongly suggests malicious document-based execution.

3. 3

   Detect encoded PowerShell commands by alerting on process creation events containing -EncodedCommand, -enc, or -e flags, followed by Base64-encoded strings, which is a common technique for bypassing simple string-based detection.

4. 4

   Alert on the use of cmd.exe or PowerShell with flags designed to bypass execution policy or disable security features, such as -ExecutionPolicy Bypass, -NonInteractive, -WindowStyle Hidden, or -NoProfile.

5. 5

   Correlate scripting interpreter activity with network connections initiated shortly after execution to identify scripts performing download-cradle operations or establishing command-and-control communications.

Example Alerts

These realistic alert examples show what Command and Scripting Interpreter looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Command and Scripting Interpreter?

Detection centers on XDR, SIEM telemetry for the execution phase of the attack. Enable PowerShell script block logging and module logging to capture the full decoded content of executed scripts, including deobfuscated payloads that may not be visible in process command line arguments alone. Monitor for command interpreter processes spawned by unusual parent processes such as Microsoft Office applications, web browsers, email clients, or PDF readers, which strongly suggests malicious document-based execution.

What does a Command and Scripting Interpreter alert look like?

A representative XDR detection is "Encoded PowerShell Command Execution" (high severity): PowerShell process launched with -EncodedCommand flag containing Base64-encoded payload that decodes to a download cradle fetching content from pastebin.com. Parent process is winword.exe, indicating macro-based execution. The downloaded script attempts to disable Windows Defender real-time protection before executing the second-stage payload.

Which tools detect Command and Scripting Interpreter, and how can I practice?

Command and Scripting Interpreter (T1059) is best surfaced with XDR, SIEM telemetry, which exposes the execution signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.