Adversaries may execute JavaScript in non-browser runtimes for code execution. This record's alternatives cover Microsoft JScript through Windows Script Host, JavaScript embedded in an HTML Application, macOS JavaScript for Automation (JXA) through osascript, and JavaScript through Node.js. A script may perform local actions or, if its code and environment allow, retrieve a secondary payload; invoking an interpreter alone does not establish that a download, payload execution, or command-and-control succeeded.
Variant:
Execute Base64 Encoded Command
powershell
RESTRICTED_ACCESS_BLUR_MARKER
RESTRICTED_ACCESS_BLUR_MARKER
RESTRICTED_ACCESS_BLUR_MARKER
RESTRICTED_ACCESS_BLUR_MARKER