T1059.007 Command and Scripting Interpreter: JavaScript

2 threats tracked by Spectrum Delta use this technique.

T1059.007 on MITRE ATT&CK →

• testmetest / CementBeetleSteeple

  Execution: postinstall addon drops hidden JavaScript and launches it as a detached node process

  Endpoint process telemetry: npm install postinstall invoking the addon, followed by a detached node process executing from the temp directory (fork/execlp on Linux, CreateProcessA on Windows); endpoint file telemetry: .napi_cache appearing inside the package directory, hidden files created at /tmp/.<pid> (Linux) or %TEMP%\.nc<PID>.js (Windows) during installation, and the persistence paths (~/.local/bin/net-health-checker.sh, ~/.config/net-health-checker/, ~/.local/share/runtimes/sync.py, /var/tmp/.fontconfig_state). The install log stays clean by design — process and file events are the decisive evidence

  Seen in: Process-creation events (Sysmon EID 1 / auditd execve), File-creation events (Sysmon EID 11 / auditd watches)

• Amazon ClickFix (Doina)

  Node.js runtime executes AES-256-GCM-decrypted payload pair from ProgramData\NodeView

  Process-creation events (4688/Sysmon EID 1) for node.exe executing under C:\ProgramData\NodeView; EDR file events for the randomized payload pair; network flows to kiriosyka[.]com and grillmasterchef[.]com and WebSocket connections. HTTPS content is not inspectable in flow metadata; the injection step itself is not observable without injection-capable EDR telemetry

  Seen in: Network flow telemetry, EDR