H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Technique

Visual Basic

Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows technologies such as [Component Object Model](https://attack.mitre.org/techniques/T1559/001) and the [Native API](https://attack.mitre.org/techniques/T1106) through the Windows API. Although tagged as legacy with no planned future evolutions, VB is integrated and supported in the .NET Framework and cross-platform .NET Core.(Citation: VB .NET Mar 2020)(Citation: VB Microsoft) Derivative languages based on VB have also been created, such as Visual Basic for Applications (VBA) and VBScript. VBA is an event-driven programming language built into Microsoft Office, as well as several third-party applications.(Citation: Microsoft VBA)(Citation: Wikipedia VBA) VBA enables documents to contain macros used to automate the execution of tasks and other functionality on the host. VBScript is a default scripting language on Windows hosts and can also be used in place of [JavaScript](https://attack.mitre.org/techniques/T1059/007) on HTML Application (HTA) webpages served to Internet Explorer (though most modern browsers do not come with VBScript support).(Citation: Microsoft VBScript) Adversaries may use VB payloads to execute malicious commands. Common malicious usage includes automating execution of behaviors with VBScript or embedding VBA content into [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001) payloads (which may also involve [Mark-of-the-Web Bypass](https://attack.mitre.org/techniques/T1553/005) to enable execution).(Citation: Default VBS macros Blocking )

Technique
TypeTechnique
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows technologies such as [Component Object Model](https://attack.mitre.org/techniques/T1559/001) and the [Native API](https://attack.mitre.org/techniques/T1106) through the Windows API. Although tagged as legacy with no planned future evolutions, VB is integrated and supported in the .NET Framework and cross-platform .NET Core.(Citation: VB .NET Mar 2020)(Citation: VB Microsoft) Derivative languages based on VB have also been created, such as Visual Basic for Applications (VBA) and VBScript. VBA is an event-driven programming language built into Microsoft Office, as well as several third-party applications.(Citation: Microsoft VBA)(Citation: Wikipedia VBA) VBA enables documents to contain macros used to automate the execution of tasks and other functionality on the host. VBScript is a default scripting language on Windows hosts and can also be used in place of [JavaScript](https://attack.mitre.org/techniques/T1059/007) on HTML Application (HTA) webpages served to Internet Explorer (though most modern browsers do not come with VBScript support).(Citation: Microsoft VBScript) Adversaries may use VB payloads to execute malicious commands. Common malicious usage includes automating execution of behaviors with VBScript or embedding VBA content into [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001) payloads (which may also involve [Mark-of-the-Web Bypass](https://attack.mitre.org/techniques/T1553/005) to enable execution).(Citation: Default VBS macros Blocking )

137 recorded

Relationships

mitigates
from Antivirus/Antimalware
Mitigation
mitigates
from Behavior Prevention on Endpoint
Mitigation
mitigates
from Disable or Remove Feature or Program
Mitigation
mitigates
from Execution Prevention
Mitigation
mitigates
from Restrict Web-Based Content
Mitigation
subtechnique-of
to Command and Scripting Interpreter
Technique
uses
from 2015 Ukraine Electric Power Attack
Campaign
uses
from 2016 Ukraine Electric Power Attack
Campaign
uses
from APT32
Group
uses
from APT33
Group
uses
from APT37
Group
uses
from APT38
Group
uses
from APT39
Group
uses
from APT42
Group
uses
from APT-C-36
Group
uses
from Astaroth
Malware
uses
from BabyShark
Malware
uses
from BackConfig
Malware
uses
from Bandook
Malware
uses
from Bisonal
Malware
uses
from BRONZE BUTLER
Group
uses
from Bumblebee
Malware
uses
from C0011
Campaign
uses
from C0015
Campaign
uses
from Chaes
Malware
uses
from CHIMNEYSWEEP
Malware
uses
from Cobalt Group
Group
uses
from Cobalt Strike
Malware
uses
from Comnie
Malware
uses
from Confucius
Group
uses
from Contagious Interview
Group
uses
from DanBot
Malware
uses
from DarkGate
Malware
uses
from Donut
Tool
uses
from Earth Lusca
Group
uses
from Emotet
Malware
uses
from Exaramel for Windows
Malware
uses
from Ferocious
Malware
uses
from FIN13
Group
uses
from FIN4
Group
uses
from FIN7
Group
uses
from Flagpro
Malware
uses
from Frankenstein
Campaign
uses
from FunnyDream
Campaign
uses
from Gamaredon Group
Group
uses
from Goopy
Malware
uses
from Gorgon Group
Group
uses
from Grandoreiro
Malware
uses
from Helminth
Malware
uses
from HEXANE
Group
uses
from Higaisa
Group
uses
from IcedID
Malware
uses
from Inception
Group
uses
from IPsec Helper
Malware
uses
from Javali
Malware
uses
from JCry
Malware
uses
from jRAT
Malware
uses
from JSS Loader
Malware
uses
from Juicy Mix
Campaign
uses
from Kerrdown
Malware
uses
from KeyBoy
Malware
uses
from Kimsuky
Group
uses
from Koadic
Tool
uses
from KOCTOPUS
Malware
uses
from Lazarus Group
Group
uses
from LazyScripter
Group
uses
from Leviathan
Group
uses
from Lokibot
Malware
uses
from LookBack
Malware
uses
from LunarMail
Malware
uses
from Machete
Group
uses
from Magic Hound
Group
uses
from Malteiro
Group
uses
from Melcoz
Malware
uses
from Metamorfo
Malware
uses
from MirrorFace
Group
uses
from Mispadu
Malware
uses
from Molerats
Group
uses
from MuddyWater
Group
uses
from Mustang Panda
Group
uses
from NanHaiShu
Malware
uses
from NanoCore
Malware
uses
from NETWIRE
Malware
uses
from OilRig
Group
uses
from OopsIE
Malware
uses
from Operation AkaiRyū
Campaign
uses
from Operation CuckooBees
Campaign
uses
from Operation Dream Job
Campaign
uses
from Operation Dust Storm
Campaign
uses
from Operation Honeybee
Campaign
uses
from Operation Sharpshooter
Campaign
uses
from Operation Wocao
Campaign
uses
from OSX_OCEANLOTUS.D
Malware
uses
from Outer Space
Campaign
uses
from Patchwork
Group
uses
from PoetRAT
Malware
uses
from PowerShower
Malware
uses
from POWERSTATS
Malware
uses
from Pteranodon
Malware
uses
from QakBot
Malware
uses
from QUADAGENT
Malware
uses
from Ramsay
Malware
uses
from Rancor
Group
uses
from RedCurl
Group
uses
from Remcos
Tool
uses
from Remexi
Malware
uses
from REvil
Malware
uses
from ROKRAT
Malware
uses
from Saint Bot
Malware
uses
from Sandworm Team
Group
uses
from ShrinkLocker
Malware
uses
from Sibot
Malware
uses
from SideCopy
Group
uses
from Sidewinder
Group
uses
from Silence
Group
uses
from Smoke Loader
Malware
uses
from Snip3
Malware
uses
from SolarWinds Compromise
Campaign
uses
from Squirrelwaffle
Malware
uses
from STARWHALE
Malware
uses
from StoneDrill
Malware
uses
from SUNBURST
Malware
uses
from SVCReady
Malware
uses
from SystemBC
Malware
uses
from TA2541
Group
uses
from TA459
Group
uses
from TA505
Group
uses
from TAMECAT
Malware
uses
from Transparent Tribe
Group
uses
from Turla
Group
uses
from TYPEFRAME
Malware
uses
from Ursnif
Malware
uses
from VBShower
Malware
uses
from WhisperGate
Malware
uses
from Windshift
Group
uses
from WIRTE
Group
uses
from Xbash
Malware
7 external

References

mitre-attack
T1059.005
open
VB .NET Mar 2020
https://devblogs.microsoft.com/vbteam/visual-basic-support-planned-for-net-5-0/
open
Default VBS macros Blocking
https://techcommunity.microsoft.com/t5/microsoft-365-blog/helping-users-stay-safe-blocking-internet-macros-by-default-in/ba-p/3071805
open
Microsoft VBScript
https://docs.microsoft.com/previous-versions//1kw29xwf(v=vs.85)
open
Microsoft VBA
https://docs.microsoft.com/office/vba/api/overview/
open
VB Microsoft
https://docs.microsoft.com/dotnet/visual-basic/
open
Wikipedia VBA
https://en.wikipedia.org/wiki/Visual_Basic_for_Applications
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance