Web skimmer (Magecart / formjacking)

Injected JavaScript on checkout pages steals card data

categoryMalwareseverityHighdetectability (measured in our lab)Mediumlabdetected in lab

Example: British Airways, Ticketmaster (2018)

Detection opportunity what to watch for

A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.

What the attacker runs

ATT&CK T1059.007 · JScript execution to gather local computer information via cscript · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1059.007 -Tool atomic -RunId <run-id> -Command 'Invoke-AtomicTest T1059.007 -TestGuids 01d75adf-ca1b-4dd1-ac96-7c9550ad1035 -GetPrereqs; Invoke-AtomicTest T1059.007 -TestGuids 01d75adf-ca1b-4dd1-ac96-7c9550ad1035 -TimeoutSeconds 120'

ATT&CK T1059.007 · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1059.007 -Tool atomic -RunId run-2026-11-02-004 -Command 'Invoke-AtomicTest T1059.007 -TestGuids 01d75adf-ca1b-4dd1-ac96-7c9550ad1035 -GetPrereqs; Invoke-AtomicTest T1059.007 -TestGuids 01d75adf-ca1b-4dd1-ac96-7c9550ad1035 -TimeoutSeconds 120'

ATT&CK T1059.007 · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1059.007 -Tool atomic -RunId run-2026-11-02-011 -Command 'Invoke-AtomicTest T1059.007 -TestGuids 01d75adf-ca1b-4dd1-ac96-7c9550ad1035 -GetPrereqs; Invoke-AtomicTest T1059.007 -TestGuids 01d75adf-ca1b-4dd1-ac96-7c9550ad1035 -TimeoutSeconds 120'

What our lab measured

detected windows · 2026-11-02 · detected in 61s

What it looked like in telemetry

Log source	What it means
Sysmon · EID 1	JScript executed by Windows Script Host (cscript/wscript running a .js/.jse file) -- T1059.007
Sysmon · EID 1	Suspicious Windows cmd shell execution
Sysmon · EID 1	Windows command prompt started by an abnormal process
Sysmon · EID 11	Executable file dropped in folder commonly used by malware
PowerShell · EID 4104	Powershell executed "Get-Content -Stream or Invoke-Expresion". Possible string execution as code
PowerShell · EID 4104	Powershell script querying system environment variables
PowerShell · EID 4104	Powershell script recursively collected files from a filesystem search
PowerShell · EID 4104	Powershell script searching filesystem
… and 4 more event type(s)

Detection that fired

✓ Wazuh 100466 (level 6) lab rule — JScript executed by Windows Script Host (cscript/wscript running a .js/.jse file) -- T1059.007
✓ Wazuh 100467 (level 6) lab rule — JScript executed by Windows Script Host (cscript/wscript running a .js/.jse file) (Security 4688 arm) -- T1059.007

Plus 10 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~1432 incidental alerts/hour — tune against this.

partially detected windows · 2026-11-02

What it looked like in telemetry

Log source	What it means
Sysmon · EID 1	Suspicious Windows cmd shell execution
Sysmon · EID 1	Windows command prompt started by an abnormal process
Sysmon · EID 11	Executable file dropped in folder commonly used by malware
PowerShell · EID 4104	Powershell executed "Get-Content -Stream or Invoke-Expresion". Possible string execution as code
PowerShell · EID 4104	Powershell script querying system environment variables
PowerShell · EID 4104	Powershell script recursively collected files from a filesystem search
PowerShell · EID 4104	Powershell script searching filesystem
PowerShell · EID 4104	Powershell script used "Invoke-command" cmdlet to execute sub script
… and 5 more event type(s)

Plus 13 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~5874 incidental alerts/hour — tune against this.

Classification

26 values: 3 lab-measured, 9 imported, 1 derived, 13 machine-classified. What do these mean?

Exploitability

Attack vector	Malware
Reach (CVSS)	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Attacker skill required	Medium
Resources required	Low
Likelihood / prevalence	High
Maturity	Commoditized

Impact & scope

Severity	High
Impact	ConfidentialityFinancial
Platform	LinuxmacOSWindows
Environment	Cloud
Target asset class	Web app / API
Kill-chain phase (tactic)	Execution
Remote support	No

Detection & telemetry

Detectability (measured in our lab)	Medium
Detectability (public detection content)	High
Noise level	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	Command ExecutionModule LoadProcess CreationScript Execution

Detection & response

Mitigated by 19

M1021 attack-mitigation
M1038 attack-mitigation
M1040 attack-mitigation
M1042 attack-mitigation
D3-CF d3fend
D3-CM d3fend
D3-CQ d3fend
D3-DA d3fend
D3-DF d3fend
D3-EAL d3fend
D3-EDL d3fend
D3-EFA d3fend
D3-FA d3fend
D3-FE d3fend
D3-FEV d3fend
D3-FIM d3fend
D3-LFP d3fend
D3-RF d3fend
D3-RFAM d3fend

Detected by 32

DET0264 attack-detection-strategy
002bdb95-0cf1-46a6-9e08-d38c128a6127 sigma
05c36dd6-79d6-4a9a-97da-3db20298ab2d sigma
0bcfabcb-7929-47f4-93d6-b33fb67d34d1 sigma
0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6 sigma
13db8d2e-7723-4c2c-93c1-a4d36994f7ef sigma
1e33157c-53b1-41ad-bbcc-780b80b58288 sigma
1fac1481-2dbc-48b2-9096-753c49b4ec71 sigma
2b5e4d3f-7c9a-4fab-a8d1-3e6f5a7b8c9d sigma
2e4e488a-6164-4811-9ea1-f960c7359c40 sigma
3c6f5e4a-8d0b-6abc-d9e2-4f7a6b8c9d0e sigma
401e5d00-b944-11ea-8f9a-00163ecd60ae sigma
52cad028-0ff0-4854-8f67-d25dfcbc78b4 sigma
557e3bd3-7f21-495d-8d50-7c8bdfb8041c sigma
5cddf373-ef00-4112-ad72-960ac29bac34 sigma
6c0ce3b6-85e2-49d4-9c3f-6e008ce9796e sigma
8537c866-072e-460d-bfff-aaf39cbd73d3 sigma
8a3f2c1e-5d7b-4e9a-b6c8-1f2a3d4e5f6a sigma
8d63dadf-b91b-4187-87b6-34a1114577ea sigma
99b7460d-c9f1-40d7-a316-1f36f61d52ee sigma
9b4f3d2e-6e8c-5fab-c7d9-2a3b4e5f6a7b sigma
afa71271-6a97-4e47-810f-83120fb1a4ce sigma
b730a276-6b63-41b8-bcf8-55930c8fc6ee sigma
ba3874b9-0fae-465f-836c-eb5d071a1789 sigma
cc7abbd0-762b-41e3-8a26-57ad50d2eea3 sigma
cea72823-df4d-4567-950c-0b579eaf0846 sigma
df1f26d3-bea7-4700-9ea2-ad3e990cf90e sigma
e0cfaecd-602d-41af-988d-f6ccebb2af26 sigma
e8a95b5e-c891-46e2-b33a-93937d3abc31 sigma
f1408a58-0e94-4165-b80a-da9f96cf6fc3 sigma
100466 wazuh
100467 wazuh

Tested by 5

01d75adf-ca1b-4dd1-ac96-7c9550ad1035 atomic
02428cbe-c230-4353-b31d-61c9d328b153 atomic
0709945e-4fec-4c49-9faf-c3c292a74484 atomic
9be739ec-b1ba-4950-94d0-e62444b23645 atomic
e65e6772-bfd3-4f25-934b-861d5caa34db atomic

Attack relationships

Parent: Living off the land (LOTL/LOLBins)

Lab findings

Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.

Run	Outcome	Tool	Platform	Ran at
`run-2026-11-02-011`	partially-detected	atomic	windows	2026-11-02
`run-2026-11-02-015`	detected	atomic	windows	2026-11-02

run-2026-11-02-011 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=5). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1059.007 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=155 max_level=15 dwell_s=90
run-2026-11-02-015 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=5). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1059.007 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy. [renumbered from run-2026-11-02-004 on commit: the harness reused that id because the prereq-only run-2026-11-02-004 lives in lab/results-excluded/]; expected=2 incidental=37 max_level=15 dwell_s=90

Framework references

Primary source: https://sansec.io/what-is-magecart
attack: T1059.007 (primary)

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Malware' table, line 109 of Cyber-Attack-Taxonomy.md
ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to attack:T1059.007 as the nearest framework entries; ids verified to exist in the cached catalogues.
ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 75 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0004 (Phase 4 detection lab - detonation runs 2026-11-02) — Lab detonation run-2026-11-02-011 (partially-detected) for T1059.007: no alert matched the expected technique
ev-0005 (Phase 4 detection lab - detonation runs 2026-11-02) — Lab detonation run-2026-11-02-015 (detected): Wazuh rule(s) 100466, 100467 fired on T1059.007 within the detonation window
JScript executed by Windows Script Host (cscript/wscript running a .js/.jse file) -- T1059.007