# Scripting Language Tool Substitution

- **Severity:** High
- **Signature ID:** `ba8e8ccf-b67b-5c55-8054-b55a52f51aa3`
- **MITRE ATLAS:** AML.T0050 (Command and Scripting Interpreter), AML.T0053 (AI Agent Tool Invocation)
- **OWASP:** ASI07 (Unsafe Autonomous Code Execution)

## Summary

Attackers who can't run tools like curl, nmap, or nc directly (because they're blocked or monitored) fall back on writing small Python, Node.js, or Ruby scripts that do the same job. Since detection rules are often tied to specific tool names, this substitution can slip past them.

## How the attack works

An attacker on a host finds that common CLI utilities are blocked or flagged by security tooling. Instead of using nc for a reverse shell or curl for exfiltration, they write a short script using Python's socket module for scanning, urllib/requests for HTTP transfers, or subprocess to shell out and run commands. Node.js or Ruby equivalents serve the same purpose. Because the activity now looks like generic script execution rather than a named 'hacking tool', tool-specific detections miss it.

## Why it matters

An organisation loses visibility into network scanning, data exfiltration, or command execution activity that would normally trigger alerts on the underlying CLI tools, letting the attacker operate undetected for longer.

## What you can do

- Monitor for scripting interpreters (python, node, ruby) making outbound network connections or spawning child processes, not just named CLI tools.
- Review scripts that combine imports like socket, subprocess, urllib/requests with unusual outbound destinations or execution context.
- Baseline normal developer and automation use of these libraries so genuine API calls and build scripts don't drown out real alerts.
- Restrict or log interpreter access on production and sensitive systems where ad hoc scripting isn't part of normal operations.

## Known benign look-alikes

- Legitimate Python scripts using requests/urllib to call authorised internal APIs
- Development workflows using subprocess to run build tools or linters
- Heredoc file creation (cat > script.py << 'EOF') that contains scripting imports

## References

- https://attack.mitre.org/techniques/T1059/
- https://arxiv.org/abs/2403.04783

---
Source: https://www.netzilo.com/threats/scripting-tool-substitution