Visual Basic abuse (MITRE ATT&CK T1059.005) is an Execution technique. MITRE lists Windows, Linux and macOS as platforms, though most real activity centers on Windows.
VB was created by Microsoft and interoperates with many Windows technologies, including the Component Object Model and the Native API. MITRE notes that it is tagged as legacy with no planned evolution, yet it lives on in the .NET Framework and cross-platform .NET Core. Two derivatives matter most here. VBA is the event-driven language inside Microsoft Office, used for macros. VBScript is a default scripting language on Windows hosts.
How attackers use it
MITRE describes common malicious use as automating behavior with VBScript, or embedding VBA content in spearphishing attachments. That second case may also involve Mark-of-the-Web bypass so the macro is allowed to run.
VBScript can also stand in for JavaScript on HTML Application (HTA) pages served to Internet Explorer, although most modern browsers do not ship VBScript support. The shared theme is that the interpreter is native to the OS or to Office, so the file itself can look like an ordinary document or script.
How to detect it
MITRE's detection strategy watches for chained behavior. On Windows, look for execution through cscript.exe or wscript.exe, Office process chains, or HTA use. The key pattern is an Office or HTML container that spawns a script host, which then spawns PowerShell, opens network connections, or injects into another process.
For macOS and Linux, the analytics cover VBScript or VBA run through Wine-based apps, Office for Mac abusing cross-platform .NET features, macros invoked through AppleScript, and rare invocations of scripting hosts such as mono.exe.
Useful data to collect:
- Process creation with parent and command line (Windows Security 4688 with command line auditing, or Sysmon Event ID 1).
- Network connections from script hosts (Sysmon Event ID 3).
- File creation of script files in user profile and temp folders (Sysmon Event ID 11).
How to reduce the risk
MITRE lists five mitigations:
- Disable or remove the feature. Turn off or restrict unneeded VB components.
- Antivirus or antimalware. Automatically quarantine suspicious files.
- Execution prevention. Use application control where appropriate. VBA macros obtained from the Internet, based on the Mark of the Web attribute, can be blocked by default in Office apps such as Access, Excel, PowerPoint, Visio and Word, starting in Windows Version 2203.
- Behavior prevention on endpoint. On Windows 10, enable Attack Surface Reduction rules to stop Visual Basic scripts from running potentially malicious downloaded content.
- Restrict web-based content. Script blocking extensions can stop scripts and HTA files used during exploitation, and ad blockers reduce malicious code served through ads.
Check your own environment
# Windows PowerShell: list Attack Surface Reduction rule settings (read only)
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids
# Windows: which programs are registered to open .vbs files
cmd /c assoc .vbs
Also ask a simple question of your estate: which teams actually need wscript.exe, cscript.exe or mshta.exe? If the answer is few or none, that is a candidate for application control.
Quick check
Which Office feature does the Mark of the Web mitigation target?
VBA macros in files obtained from the Internet. They can be blocked by default in Office apps starting in Windows Version 2203.
What chain should raise an alert?
An Office or HTML container spawning a script host, which then spawns PowerShell, makes network connections, or injects into a process.
