T1059.004 Unix Shell
Sub-technique of T1059 Command and Scripting Interpreter
Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution.(Citation: DieNet Bash)(Citation: Apple ZShell) Unix shells can control every aspect of a system, with certain commands…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Linux Reverse Shell Indicatorcriticaltest · linux
- AWS EC2 Startup Shell Script Changehightest · aws
- Equation Group Indicatorshightest · linux
- JexBoss Command Sequencehightest · linux
- Shell Invocation via Env Command - Linuxhightest · linux
- Suspicious Activity in Shell Commandshightest · linux
- Suspicious Reverse Shell Command Linehightest · linux
- Axios NPM Compromise Indicators - Linuxhighexperimental · linux
- Axios NPM Compromise Indicators - macOShighexperimental · macos
- Script Interpreter Spawning Credential Scanner - Linuxhighexperimental · linux
- Suspicious Download and Execute Pattern via Curl/Wgethighexperimental · linux
- Suspicious Filename with Embedded Base64 Commandshighexperimental · linux
- BPFtrace Unsafe Option Usagemediumtest · linux
- Interactive Bash Suspicious Childrenmediumtest · linux
- Nohup Executionmediumtest · linux
- Suspicious Commands Linuxmediumtest · linux
- Potential Abuse of Linux Magic System Request Keymediumexperimental · linux
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.