# T1059 Command and Scripting Interpreter > As of 2026-10-05, T1059 (Command and Scripting Interpreter) appears in 1050 tracked threats, first reported 2021-11-25 and most recently 2026-10-04, with linked actors including TeamPCP, APT38, Sapphire Sleet; it most often appears alongside T1071 (Application Layer Protocol). - **Tracked threats:** 1050 (447 critical, 527 high, 63 medium, 5 low) - **First seen:** 2021-11-25 - **Last seen:** 2026-10-04 - **Threat actors:** 189 - **Detection rules:** 662 (counts only; Blue tier and above) ## Key facts - **ID:** T1059 - **Framework:** MITRE ATT&CK - **Tactics:** Execution - **Matrix:** Enterprise - **Data as of:** 2026-10-05 - **MITRE:** https://attack.mitre.org/techniques/T1059/ ## Activity timeline T1059 first appeared in tracked threats on 2021-11-25 and was most recently reported on 2026-10-04. The busiest month was 2026-07 with 316 reports, and 1048 of the 1050 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1059 Command and Scripting Interpreter is catalogued by MITRE ATT&CK under the Execution tactic in the Enterprise matrix. Threadlinqs maps 1050 of 2623 tracked threats (40%) to it; by severity that is 447 critical, 527 high, 63 medium, 5 low. Threats that use T1059 most often also use [T1071 Application Layer Protocol](https://intel.threadlinqs.com/technique/T1071) (656 threats), [T1005 Data from Local System](https://intel.threadlinqs.com/technique/T1005) (595 threats), [T1027 Obfuscated Files or Information](https://intel.threadlinqs.com/technique/T1027) (593 threats), [T1082 System Information Discovery](https://intel.threadlinqs.com/technique/T1082) (593 threats), [T1036 Masquerading](https://intel.threadlinqs.com/technique/T1036) (539 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 189 tracked threat actors appear in the threats that use T1059; the most frequent are [TeamPCP](https://intel.threadlinqs.com/actor/TeamPCP) (30), [APT38](https://intel.threadlinqs.com/actor/APT38) (20), [Sapphire Sleet](https://intel.threadlinqs.com/actor/Sapphire%20Sleet) (18), [Stardust Chollima](https://intel.threadlinqs.com/actor/Stardust%20Chollima) (17), [Lazarus Group](https://intel.threadlinqs.com/actor/Lazarus%20Group) (14). ## Mitigations MITRE ATT&CK lists 9 mitigations for T1059. - [M1021 Restrict Web-Based Content](https://attack.mitre.org/mitigations/M1021/) - [M1026 Privileged Account Management](https://attack.mitre.org/mitigations/M1026/) - [M1033 Limit Software Installation](https://attack.mitre.org/mitigations/M1033/) - [M1038 Execution Prevention](https://attack.mitre.org/mitigations/M1038/) - [M1040 Behavior Prevention on Endpoint](https://attack.mitre.org/mitigations/M1040/) - [M1042 Disable or Remove Feature or Program](https://attack.mitre.org/mitigations/M1042/) - [M1045 Code Signing](https://attack.mitre.org/mitigations/M1045/) - [M1047 Audit](https://attack.mitre.org/mitigations/M1047/) - [M1049 Antivirus/Antimalware](https://attack.mitre.org/mitigations/M1049/) ## Data sources Telemetry that can reveal T1059, per MITRE ATT&CK. - Command — Command Execution - Module — Module Load - Process — Process Creation, Process Metadata - Script — Script Execution ## Threat actors using it - [TeamPCP](https://intel.threadlinqs.com/actor/TeamPCP) — 30 - [APT38](https://intel.threadlinqs.com/actor/APT38) — 20 - [Sapphire Sleet](https://intel.threadlinqs.com/actor/Sapphire%20Sleet) — 18 - [Stardust Chollima](https://intel.threadlinqs.com/actor/Stardust%20Chollima) — 17 - [Lazarus Group](https://intel.threadlinqs.com/actor/Lazarus%20Group) — 14 - [MuddyWater](https://intel.threadlinqs.com/actor/MuddyWater) — 14 - [Contagious Interview](https://intel.threadlinqs.com/actor/Contagious%20Interview) — 12 - [APT28](https://intel.threadlinqs.com/actor/APT28) — 11 - [Andariel](https://intel.threadlinqs.com/actor/Andariel) — 11 - [Forest Blizzard](https://intel.threadlinqs.com/actor/Forest%20Blizzard) — 11 - [BlueDelta](https://intel.threadlinqs.com/actor/BlueDelta) — 9 - [Static Tundra](https://intel.threadlinqs.com/actor/Static%20Tundra) — 9 ## Tracked threats The 30 most recent of 1050 tracked threats that use T1059. - [CISA adds Citrix NetScaler SAML memory overflow DoS (CVE-2026-88779) to KEV Catalog](https://intel.threadlinqs.com/threat/TL-2026-2896) — high — 2026-10-04 - [Vercel Confirms KVM Zero-Day Guest-to-Host VM Escape (Root on Host) via Sandbox Bug Bounty; $50,000 Bounty…](https://intel.threadlinqs.com/threat/TL-2026-2878) — high — 2026-10-04 - [Desktop AI Supercomputers, Uncensored Models and Agentic Frameworks (HexStrike-AI) Enable Automated…](https://intel.threadlinqs.com/threat/TL-2026-2881) — high — 2026-10-03 - [Kiteworks 9.5.1 Patches 126 Vulnerabilities Including Critical Account Takeover in Core and Email Protection…](https://intel.threadlinqs.com/threat/TL-2026-2902) — critical — 2026-10-02 - [Multiple Vulnerabilities in Apache HTTP Server 2.4.0 through 2.4.68 (20 CVEs, fixed in 2.4.69)](https://intel.threadlinqs.com/threat/TL-2026-2876) — medium — 2026-10-02 - [GitLab AI Gateway critical RCE via prompt template sandbox escape (CVE-2026-90970)](https://intel.threadlinqs.com/threat/TL-2026-2846) — critical — 2026-10-02 - [CISA adds two Zammad vulnerabilities to KEV: CVE-2026-102489 (session fixation to RCE) and CVE-2026-102490…](https://intel.threadlinqs.com/threat/TL-2026-2843) — critical — 2026-10-02 - [Bitget $387.5M Cryptocurrency Theft via Third-Party Security Product Zero-Day (Suspected DPRK / TraderTraitor)](https://intel.threadlinqs.com/threat/TL-2026-2823) — critical — 2026-10-01 - [WatchGuard Fireware OS Critical Code Injection Vulnerability in BOVPN over TLS Client (CVE-2026-86131)](https://intel.threadlinqs.com/threat/TL-2026-2813) — critical — 2026-09-30 - [Critical MikroTik RouterOS Integer Underflow Vulnerability (CVE-2026-84411) Enables Unauthenticated Remote…](https://intel.threadlinqs.com/threat/TL-2026-2805) — critical — 2026-09-30 - [Agentic AI used for post-exploitation in breach of the Dutch Institute for Vulnerability Disclosure (DIVD)](https://intel.threadlinqs.com/threat/TL-2026-2793) — high — 2026-09-29 - [Comment2Shell: Unauthenticated Stored XSS-to-RCE Chain in WordPress wpautop() (CVE-2026-93485)](https://intel.threadlinqs.com/threat/TL-2026-2717) — high — 2026-09-27 - [CISA Adds Two Citrix NetScaler Vulnerabilities (CVE-2026-88771, CVE-2026-88772) to KEV Catalog](https://intel.threadlinqs.com/threat/TL-2026-2711) — critical — 2026-09-27 - [Citrix Patches Two Actively Exploited NetScaler Zero-Days (CVE-2026-88771, CVE-2026-88772)](https://intel.threadlinqs.com/threat/TL-2026-2703) — critical — 2026-09-27 - [Cloudflare Containers Cross-Tenant Data Exposure via Unzeroed Reused Storage Blocks (skip_block_zeroing)](https://intel.threadlinqs.com/threat/TL-2026-2698) — high — 2026-09-27 - [Two Unpatched Citrix NetScaler Zero-Day RCE Vulnerabilities Under Active Exploitation](https://intel.threadlinqs.com/threat/TL-2026-2693) — critical — 2026-09-27 - [Two Unpatched Citrix NetScaler ADC/Gateway RCE Zero-Days Under Active Exploitation](https://intel.threadlinqs.com/threat/TL-2026-2688) — critical — 2026-09-27 - [UTA0565 Chains Chrome and Windows Zero-Days (CVE-2026-85046, CVE-2026-87491, CVE-2026-85880) to Deploy…](https://intel.threadlinqs.com/threat/TL-2026-2681) — critical — 2026-09-27 - [Check Point Security Gateway VPN Pre-Auth RCE (CVE-2026-85102) and Management Path Traversal Zero-Day…](https://intel.threadlinqs.com/threat/TL-2026-2677) — critical — 2026-09-26 - [CISA Adds Two Actively Exploited KEVs: SharePoint Code Injection (CVE-2026-65660) and Mikrotik RouterOS Auth…](https://intel.threadlinqs.com/threat/TL-2026-2669) — critical — 2026-09-26 - [AI-Powered Cyber Attacks: Emerging TTPs Across Phishing, Deepfake BEC, Polymorphic Malware, and Prompt…](https://intel.threadlinqs.com/threat/TL-2026-2668) — medium — 2026-09-26 - [CISA Adds Actively Exploited WSO2 API Manager and Adobe Commerce Flaws to KEV Catalog, Warns on SharePoint…](https://intel.threadlinqs.com/threat/TL-2026-2680) — critical — 2026-09-25 - [Critical ServiceNow AI Platform Vulnerabilities: Unauthenticated SQL Injection and Authorization Bypasses…](https://intel.threadlinqs.com/threat/TL-2026-2653) — critical — 2026-09-25 - [SectopRAT (ArechClient2) Variant Hidden Inside Legitimate Italian Digital-Audio Software via…](https://intel.threadlinqs.com/threat/TL-2026-2646) — high — 2026-09-25 - [TokenGrabber: Python-based MaaS Infostealer Builder](https://intel.threadlinqs.com/threat/TL-2026-2643) — high — 2026-09-25 - [cPanel/WHM CalDAV/CardDAV and WP Toolkit Flaws Enable Cross-Account Access and Root Privilege Escalation…](https://intel.threadlinqs.com/threat/TL-2026-2636) — critical — 2026-09-23 - [CVE-2026-87902: Critical Unauthenticated Local File Inclusion in WordPress Core (Conditional RCE)](https://intel.threadlinqs.com/threat/TL-2026-2623) — critical — 2026-09-22 - [Check Point Patches Actively Exploited Zero-Day Path Traversal in Management Server (CVE-2026-93616)](https://intel.threadlinqs.com/threat/TL-2026-2617) — critical — 2026-09-22 - [PowerShell Cryptomining Loader Abuses Registry-Resident Scripts, DNS TXT Records, and PNG/WAV Steganography…](https://intel.threadlinqs.com/threat/TL-2026-2593) — medium — 2026-09-20 - [SolarWinds Access Rights Manager Hard-Coded Cryptographic Key (CVE-2026-28326) Enables Unauthenticated RCE](https://intel.threadlinqs.com/threat/TL-2026-2585) — critical — 2026-09-19 ## Related CVEs CVEs referenced by the tracked threats that use T1059, most frequent first. - [CVE-2026-45659](https://intel.threadlinqs.com/cve/CVE-2026-45659) - [CVE-2026-56164](https://intel.threadlinqs.com/cve/CVE-2026-56164) - [CVE-2026-32201](https://intel.threadlinqs.com/cve/CVE-2026-32201) - [CVE-2025-55182](https://intel.threadlinqs.com/cve/CVE-2025-55182) - [CVE-2026-15409](https://intel.threadlinqs.com/cve/CVE-2026-15409) - [CVE-2026-56155](https://intel.threadlinqs.com/cve/CVE-2026-56155) - [CVE-2026-58644](https://intel.threadlinqs.com/cve/CVE-2026-58644) - [CVE-2018-0171](https://intel.threadlinqs.com/cve/CVE-2018-0171) - [CVE-2026-15410](https://intel.threadlinqs.com/cve/CVE-2026-15410) - [CVE-2026-20230](https://intel.threadlinqs.com/cve/CVE-2026-20230) - [CVE-2026-50661](https://intel.threadlinqs.com/cve/CVE-2026-50661) - [CVE-2026-55040](https://intel.threadlinqs.com/cve/CVE-2026-55040) - [CVE-2024-21762](https://intel.threadlinqs.com/cve/CVE-2024-21762) - [CVE-2026-21509](https://intel.threadlinqs.com/cve/CVE-2026-21509) - [CVE-2026-33825](https://intel.threadlinqs.com/cve/CVE-2026-33825) - [CVE-2026-50522](https://intel.threadlinqs.com/cve/CVE-2026-50522) - [CVE-2008-4128](https://intel.threadlinqs.com/cve/CVE-2008-4128) - [CVE-2021-26855](https://intel.threadlinqs.com/cve/CVE-2021-26855) - [CVE-2021-44228](https://intel.threadlinqs.com/cve/CVE-2021-44228) - [CVE-2022-40684](https://intel.threadlinqs.com/cve/CVE-2022-40684) - [CVE-2024-21887](https://intel.threadlinqs.com/cve/CVE-2024-21887) - [CVE-2025-8088](https://intel.threadlinqs.com/cve/CVE-2025-8088) - [CVE-2026-21513](https://intel.threadlinqs.com/cve/CVE-2026-21513) - [CVE-2026-24858](https://intel.threadlinqs.com/cve/CVE-2026-24858) - [CVE-2026-48282](https://intel.threadlinqs.com/cve/CVE-2026-48282) - [CVE-2016-4437](https://intel.threadlinqs.com/cve/CVE-2016-4437) - [CVE-2017-17215](https://intel.threadlinqs.com/cve/CVE-2017-17215) - [CVE-2021-29441](https://intel.threadlinqs.com/cve/CVE-2021-29441) - [CVE-2023-27997](https://intel.threadlinqs.com/cve/CVE-2023-27997) - [CVE-2023-46805](https://intel.threadlinqs.com/cve/CVE-2023-46805) ## Detection coverage Threadlinqs maintains 662 detection rules mapped to T1059 (SPL 232, KQL 219, Sigma 211). Rule content is available to Blue tier accounts and above; this page shows counts only. 662 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Sub-techniques - [T1059.001 PowerShell](https://intel.threadlinqs.com/technique/T1059.001) — 342 tracked threats - [T1059.002 AppleScript](https://intel.threadlinqs.com/technique/T1059.002) — 29 tracked threats - [T1059.003 Windows Command Shell](https://intel.threadlinqs.com/technique/T1059.003) — 205 tracked threats - [T1059.004 Unix Shell](https://intel.threadlinqs.com/technique/T1059.004) — 276 tracked threats - [T1059.005 Visual Basic](https://intel.threadlinqs.com/technique/T1059.005) — 75 tracked threats - [T1059.006 Python](https://intel.threadlinqs.com/technique/T1059.006) — 150 tracked threats - [T1059.007 JavaScript](https://intel.threadlinqs.com/technique/T1059.007) — 241 tracked threats - T1059.008 Network Device CLI — 5 tracked threats - T1059.009 Cloud API — 3 tracked threats - T1059.010 AutoHotKey & AutoIT — 9 tracked threats - T1059.011 Lua — 6 tracked threats - T1059.012 Hypervisor CLI — 0 tracked threats - T1059.013 Container CLI/API — 0 tracked threats ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1059 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)