T1059No distinct observable

Command and Scripting Interpreter

ExecutionContainers, ESXi, IaaS, Identity Provider, Linux, macOS, Network Devices, Office Suite, SaaS, Windows

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

Every observable in this brief is a child's, and the only thing that would make it parent-level is not expressible in the Sigma subset this corpus models. AN1428 (Windows, process_creation) names powershell.exe, cmd.exe and wscript.exe explicitly, which are T1059.001, T1059.003 and T1059.005 respectively; AN1429 (Linux, process_creation) names bash and sh (T1059.004), python (T1059.006), perl and ruby. A rule keyed on those images would be a child's detection filed under the parent tag, which is exactly the mislabelling AUTHORING.md rule 3 exists to prevent. […]

Covered instead by T1059.001, T1059.003, T1059.004, T1059.005, T1059.006, T1059.007.

What the technique is

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell. There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic. Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services in order to achieve remote Execution.

Read it on attack.mitre.org

What MITRE says you would watch

AN1428
Detects the execution of scripting or command interpreters (e.g., powershell.exe, cmd.exe, wscript.exe) outside expected administrative time windows or from abnormal user contexts, often followed by encoded/obfuscated arguments or secondary execution events.
AN1429
Detects use of shell interpreters (e.g., bash, sh, python, perl) initiated by users or processes not normally executing them, especially when chaining suspicious utilities like netcat, curl, or ssh.
AN1430
Detects launch of command-line interpreters via Terminal, Automator, or hidden osascript, especially when parent process lineage deviates from user-initiated applications.