T1059.005 Visual Basic

Technique

T1059.005

Tactics

Execution

Research, 90 days

2

KEV CVEs mapped

0

SigmaHQ rules

29

Elastic, Splunk

26

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1059/005

MITRE description

Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows technologies such as [Component Object Model](https://attack.mitre.org/techniques/T1559/001) and the [Native API](https://attack.mitre.org/techniques/T1106) through the Windows API. Although tagged as legacy with no planned future evolutions, VB is integrated and supported in the .NET Framework and cross-platform .NET Core.(Citation: VB .NET Mar 2020)(Citation: VB Microsoft) Derivative languages based on VB have also been created, such as Visual Basic for Applications (VBA) and VBScript. VBA is an event-driven programming language built into Microsoft Office, as well as several third-party applications.(Citation: Microsoft VBA)(Citation: Wikipedia VBA) VBA enables documents to contain macros used to automate the execution of tasks and other functionality on the host. VBScript is a default scripting language on Windows hosts and can also be used in place of [JavaScript](https://attack.mitre.org/techniques/T1059/007) on HTML Application (HTA) webpages served to Internet Explorer (though most modern browsers do not come with VBScript support).(Citation: Microsoft VBScript) Adversaries may use VB payloads to execute malicious commands. Common malicious usage includes automating execution of behaviors with VBScript or embedding VBA content into [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001) payloads (which may also involve [Mark-of-the-Web Bypass](https://attack.mitre.org/techniques/T1553/005) to enable execution).(Citation: Default VBS macros Blocking )

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-11-03 Flare: Inside a Microsoft Lookalike Domain Masquerading as Czech Company’s IT Department Infrastructure
• 2026-08-27 Recorded Future Insikt: BlueDelta Targets Defense and Diplomacy with HOOKEDGE

Detection coverage

SigmaHQ community rules

• Adwind RAT / JRAT (emerging-threats)
• Potential APT10 Cloud Hopper Activity (emerging-threats)
• Potential QBot Activity (emerging-threats)
• Axios NPM Compromise Indicators - Windows (emerging-threats)
• WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript (threat-hunting)
• AppLocker Prevented Application or Script from Running (core)
• AppLocker Application Would Have Been Blocked (core)
• HackTool - CACTUSTORCH Remote Thread Creation (core)
• WScript or CScript Dropper - File (core)
• HackTool - NetExec File Indicators (core)
• Adwind RAT / JRAT File Artifact (core)
• MMC Loading Script Engines DLLs (core)
• Registry Modification Attempt Via VBScript - PowerShell (core)
• Suspicious Child Process Of BgInfo.EXE (core)
• Uncommon Child Process Of BgInfo.EXE (core)
• Csc.EXE Execution Form Potentially Suspicious Parent (core)
• HTML Help HH.EXE Suspicious Child Process (core)
• Suspicious HH.EXE Execution (core)
• HackTool - Koadic Execution (core)
• Potential Reconnaissance Activity Via GatherNetworkInfo.VBS (core)
• Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS (core)
• Windows Shell/Scripting Processes Spawning Suspicious Programs (core)
• Registry Modification Attempt Via VBScript (core)
• Potential Remote SquiblyTwo Technique Execution (core)
• XSL Script Execution Via WMIC.EXE (core)

Showing 25 of 29 community rules. the full set is tagged attack.t1059.005 in SigmaHQ.

Elastic and Splunk rules

• Potential Prompt Injection Coercing Shell Execution (elastic)
• Script Interpreter Connection to Non-Standard Port (elastic)
• Remote File Download via Script Interpreter (elastic)
• Suspicious ScreenConnect Client Child Process (elastic)
• Suspicious .NET Code Compilation (elastic)
• Microsoft Build Engine Started by a Script Process (elastic)
• Script Execution via Microsoft HTML Application (elastic)
• Delayed Execution via Ping (elastic)
• Command and Scripting Interpreter via Windows Scripts (elastic)
• Windows Script Execution from Archive (elastic)
• Microsoft Management Console File from Unusual Path (elastic)
• Execution of a Downloaded Windows Script (elastic)
• Windows Script Executing PowerShell (elastic)
• Windows Script Interpreter Executing Process via WMI (elastic)
• Suspicious Explorer Child Process (elastic)
• Remote XSL Script Execution via COM (elastic)
• Scheduled Task Created by a Windows Script (elastic)
• Web Shell Detection: Script Process Child of Common Web Processes (elastic)
• Service Control Spawned via Script Interpreter (elastic)
• Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI (splunk)
• Cisco NVM - Susp Script From Archive Triggering Network Activity (splunk)
• Execute Javascript With Jscript COM CLSID (splunk)
• Vbscript Execution Using Wscript App (splunk)
• Windows Outlook Macro Created by Suspicious Process (splunk)
• Suspicious Process DNS Query Known Abuse Web Services (splunk)

Showing 25 of 26.

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.