166 terms · 75/46/45
Technique № 027 · class: discovery

Automation & Scripting

Automation and scripting involves using scripts, tools, and automated procedures to accelerate and scale activities within a compromised environment. Attackers leverage system scripting interpreters, configuration management tools, and custom scripts.

Term

description · examples · notes

Automation and scripting involves using scripts, tools, and automated procedures to accelerate and scale activities within a compromised environment. Attackers leverage system scripting interpreters, configuration management tools, and custom scripts.

Description

This technique enables the attacker to rapidly collect data from many systems, make mass changes, or carry out lateral movement in a short timeframe.

Examples

  • Script that automatically harvests passwords from all domain workstations
  • Using a configuration management tool to distribute malware to all servers
  • Automated network scanning and information collection on all active systems

Notes

  • Restricting access to scripting interpreters and monitoring script execution aids in detection.

Mentioned in the news

tags
execution evasion
◳Composite

Threats

used by 6

Threats that use it. Select one to open its page.

Defenses

countered by 7

How it is countered. Select one to open its page.