T1059 — Command and Scripting Interpreter
MITRE ATT&CK technique observed against the OffSeq honeypot fleet
Last 30 days · #10 most-observed technique · last seen 21 minutes ago
59,952
Observed attacks
804
Distinct source IPs
The #10 most-observed ATT&CK technique across captured attacks.
Command execution via a scripting interpreter after gaining access. OffSeq honeypots observed this technique in 59,952 attacks from 804 distinct source IPs over the last 30 days.
Top CVEs exploited across the fleet (last 30 days)
Fleet-wide, not scoped to T1059.
- CVE-2017-01442,731
- CVE-2019-07082,655
- CVE-2024-45771,682
- CVE-2021-268551,652
- CVE-2017-9841542
- CVE-2025-5777269
- CVE-2023-3519150
- CVE-2012-212283