Implementing MITRE D3FEND for ATT&CK Technique T1059: Command and Scripting Interpreter

Command and Scripting Interpreter attacks were the second most common technique seen in MITRE’s Engenuity’s Sightings Ecosystem report, representing 15.77% of 1.1 million sightings. MITRE’s D3FEND matrix outlines how to address this technique however security teams struggle to consistently implement D3FEND’s recommendations.

This blog demonstrates how Security Orchestration, Automation, and Response (SOAR) can be used to consistently implement each stage of the D3FEND framework.

MITRE ATT&CK Technique Overview

The Command and Scripting Interpreter technique (ATT&CK technique T1059) refers to the …

address att attacks automation blog command cybersecurity ecosystem incident response matrix mitre mitre attack mitre d3fend orchestration recommendations report scripting security security orchestration security teams soar teams