JavaScript abuse (MITRE ATT&CK T1059.007) is an Execution technique covering several implementations of the same language. MITRE lists Linux, macOS and Windows as platforms.
JavaScript is a platform-independent scripting language, compiled just in time at runtime, and most people associate it with web pages. But it can also run in environments outside the browser. Three flavors matter for defenders:
- JavaScript in general, including runtimes outside the browser.
- JScript, Microsoft's implementation, interpreted by the Windows Script engine and tied to components such as the Component Object Model and Internet Explorer HTML Application (HTA) pages.
- JavaScript for Automation (JXA), a macOS scripting language built on JavaScript and part of Apple's Open Scripting Architecture, introduced in OSX 10.10. Scripts can run through the
osascriptcommand line utility, be compiled withosacompile, or be compiled and executed in memory through the OSAKit framework.
How attackers use it
MITRE gives two common uses. One is hosting malicious scripts on websites as part of a drive-by compromise. The other is downloading and executing script files as secondary payloads.
Since these payloads are text-based, MITRE notes it is very common for adversaries to obfuscate the content. That makes simple string matching weak, and pushes you toward detecting what the script host does rather than what the file says.
How to detect it
MITRE's detection strategy has three analytics:
- Windows Script Host and HTA: wscript.exe, cscript.exe or mshta.exe, especially when started by Office macros, web browsers or abnormal user paths, and correlated with outbound network activity or system changes.
- macOS JXA: osascript or compiled scripts using OSAKit APIs, where the activity involves system modification, inter-process scripting or browser abuse.
- Node.js and other interpreters: execution from web shells, cron jobs or local users, tied to reverse shell behavior, file modifications or unusual outbound connections.
Practical data sources: process creation with parent and command line (Sysmon Event ID 1 or Windows Security 4688 with command line auditing), network connections per process (Sysmon Event ID 3), and on macOS the unified log.
Parent process is the single best field. A script host launched by a browser or document is rarely what an admin meant to do.
How to reduce the risk
MITRE lists four mitigations:
- Behavior prevention on endpoint. On Windows 10, enable Attack Surface Reduction rules to stop JavaScript from executing potentially malicious downloaded content.
- Execution prevention. Denylist scripting where appropriate.
- Disable or remove the feature. Turn off or restrict unneeded scripting components.
- Restrict web-based content. Script blocking extensions can stop JavaScript and HTA files used during exploitation, and ad blockers can stop malicious code served through ads.
A note on packages
JavaScript also reaches your estate through dependencies. A package pulled into a build can run script code on a developer machine or CI runner. If you want a quick look at what your project pulls in, the free in-browser dependency scan at gold.safeguard.sh/scan needs no login, keeps your file on your machine, and handles up to 100 dependencies.
Try it yourself
Click through it at your own pace, or open it full screen.
Check your own environment
# Windows PowerShell: which program opens .js and .hta files by default
cmd /c assoc .js
cmd /c assoc .hta
# Windows PowerShell: list ASR rule IDs configured on this host
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids
# macOS: recent osascript activity in the unified log
log show --last 1h --predicate 'process == "osascript"' | head -50
Ask three questions. Do users need wscript.exe, cscript.exe or mshta.exe? Can browsers launch them at all? Do your process logs record parent and command line on every endpoint?
Quick check
What is JXA?
JavaScript for Automation, a macOS scripting language based on JavaScript and part of Apple's Open Scripting Architecture. It runs through osascript, osacompile or the OSAKit framework.
Why is signature matching weak against these payloads?
Script payloads are text and commonly obfuscated, so behavior and process lineage are more reliable.
Name two mitigations MITRE lists.
Attack Surface Reduction rules on Windows 10, denylisting scripting where appropriate, disabling unneeded scripting components, and script blocking extensions.
