CyberStack

MITRE ATT&CK / Techniques / T1059.005

Command and Scripting Interpreter: Visual Basic

ID
T1059.005
Tactics
TA0002 Execution
Sub-technique of
T1059 Command and Scripting Interpreter
Platforms
Linux, macOS, Windows
Data sources
Process Creation, Module Load, Script Execution, Command Execution
Source
attack.mitre.org
MITRE last modified
12 May 2026

Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows technologies such as Component Object Model and the Native API through the Windows API. Although tagged as legacy with no planned future evolutions, VB is integrated and supported in the .NET Framework and cross-platform .NET Core.[3][4]

Derivative languages based on VB have also been created, such as Visual Basic for Applications (VBA) and VBScript. VBA is an event-driven programming language built into Microsoft Office, as well as several third-party applications.[5][6] VBA enables documents to contain macros used to automate the execution of tasks and other functionality on the host. VBScript is a default scripting language on Windows hosts and can also be used in place of JavaScript on HTML Application (HTA) webpages served to Internet Explorer (though most modern browsers do not come with VBScript support).[7]

Adversaries may use VB payloads to execute malicious commands. Common malicious usage includes automating execution of behaviors with VBScript or embedding VBA content into Spearphishing Attachment payloads (which may also involve Mark-of-the-Web Bypass to enable execution).[1]

Detection

Mitigations (5)

M1021 Restrict Web-Based Content

Script blocking extensions can help prevent the execution of scripts and HTA files that may commonly be used during the exploitation process. For malicious code served up through ads, adblockers can help prevent that code from executing in the first place.

M1038 Execution Prevention

Use application control where appropriate. VBA macros obtained from the Internet, based on the file's Mark of the Web (MOTW) attribute, may be blocked from executing in Office applications (ex: Access, Excel, PowerPoint, Visio, and Word) by default starting in Windows Version 2203.[1]

M1040 Behavior Prevention on Endpoint

On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent Visual Basic scripts from executing potentially malicious downloaded content [2].

M1042 Disable or Remove Feature or Program

Turn off or restrict access to unneeded VB components.

M1049 Antivirus/Antimalware

Anti-virus can be used to automatically quarantine suspicious files.

Groups (46)

Software (69)

Showing 60 of 69. Full list on attack.mitre.org.

References

  1. Default VBS macros Blocking
  2. win10_asr
  3. VB .NET Mar 2020
  4. VB Microsoft
  5. Microsoft VBA
  6. Wikipedia VBA
  7. Microsoft VBScript