Command and Scripting Interpreter
Technique · ATTACK:ics:T1701
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:ics:T1701",
"title": "Command and Scripting Interpreter",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1701",
"snapshot": "ics-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--abc2529d-70c0-4971-b25f-0dce8cffb427",
"external_id": "T1701",
"domain": "ics",
"created": "2026-09-25T16:36:36.601Z",
"modified": "2026-10-09T16:56:53.660Z",
"version": "1.0",
"aliases": [
],
"tactics": [
"execution"
],
"source_references": [
{
"source_name": "Remote Shell Execution in Python",
"url": "https://www.thepythoncode.com/article/executing-bash-commands-remotely-in-python"
},
{
"source_name": "Cisco IOS Software Integrity Assurance - Command History",
"url": "https://tools.cisco.com/security/center/resources/integrity_assurance.html#23"
},
{
"source_name": "Powershell Remote Commands",
"url": "https://docs.microsoft.com/en-us/powershell/scripting/learn/remoting/running-remote-commands?view=powershell-7.1"
}
]
}Explicit source assertions (11)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:ics:M0938 → mitigates → ATTACK:ics:T1701
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4c4fe037-c9ae-4f38-b717-901d3ce09528
ATTACK:ics:S1165 → uses → ATTACK:ics:T1701
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--65b57405-c7f6-432b-83ac-9571563250db
Dragos FROSTYGOOP 2024 · Nozomi BUSTLEBERM 2024ATTACK:ics:T1701.001 → subtechnique-of → ATTACK:ics:T1701
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--67a85278-577c-4e8a-a668-83f43edb9742
ATTACK:ics:T1701.002 → subtechnique-of → ATTACK:ics:T1701
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--70e47417-e7ae-4558-8382-6582e897869c
ATTACK:ics:M0948 → mitigates → ATTACK:ics:T1701
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--92c8e2f2-0670-49a8-855c-4c5d1492fa36
ATTACK:ics:T1701.003 → subtechnique-of → ATTACK:ics:T1701
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9f54f1ed-0390-4d21-9929-0bd57e821a68
ATTACK:ics:M0942 → mitigates → ATTACK:ics:T1701
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9f5e8e35-663e-477b-86ab-75dfc9695ed8
ATTACK:ics:C0030 → uses → ATTACK:ics:T1701
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c8d9d10f-bf72-4340-a613-fa08f2dde557
FireEye TRITON Dec 2017ATTACK:ics:T1701.005 → subtechnique-of → ATTACK:ics:T1701
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--da7ee266-be41-4b80-a71b-7e067e6bdb5a
ATTACK:ics:T1701.004 → subtechnique-of → ATTACK:ics:T1701
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e48987f0-bbe0-4b73-ba70-d5e660ef9ac8
ATTACK:ics:T1701.006 → subtechnique-of → ATTACK:ics:T1701
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eeb2a16d-5a4c-4d58-b4ed-c21320b5c569