Techniques › T1059.007 › AN0735
AN0735 Analytic 0735
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects Node.js or JavaScript interpreter execution from web shells, cron jobs, or local users. Correlates execution with reverse shell behavior, file modifications, or abnormal outbound connections.</p>
- Detects
- T1059.007 JavaScript
- Part of
- DET0264 Cross-Platform Detection of JavaScript Execution Abuse
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | execve | DC0032 Process Creation |
| linux:syslog | /var/log/syslog | DC0029 Script Execution |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
ScriptPath | Script launched from /tmp, /var/tmp, or hidden dot directories. |
BinaryName | Custom compiled JS binaries like node_shell or interpreter disguises. |
UserExecutionContext | Execution by service accounts or low-privilege users running cron scripts. |
NetworkFollowUp | Connection attempts to C2 post-node.js execution. |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2013-3346 | Adobe Reader and Acrobat | Mapped |
| CVE-2015-5119 | Adobe Flash Player | Mapped |
| CVE-2018-4990 | Adobe Acrobat and Reader | Mapped |
| CVE-2021-21148 | Google Chromium V8 | Mapped |
| CVE-2021-21166 | Google Chromium | Mapped |
| CVE-2021-21206 | Google Chromium Blink | Mapped |
| CVE-2021-30554 | Google Chromium WebGL | Mapped |
| CVE-2021-37975 | Google Chromium V8 | Mapped |
| CVE-2022-22963 | VMware Tanzu Spring Cloud | Mapped |
| CVE-2022-24682 | Synacor Zimbra Collaborate Suite (ZCS) | Mapped |
| CVE-2023-22515 | Atlassian Confluence Data Center and Server | Mapped |
| CVE-2023-26360 | Adobe ColdFusion | Mapped |
| CVE-2023-5631 | Roundcube Webmail | Mapped |
| CVE-2025-34028 | Commvault Command Center | Mapped |