T1059.004 Unix Shell
Subtécnica de T1059 Command and Scripting Interpreter
Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution.(Citation: DieNet Bash)(Citation: Apple ZShell) Unix shells can control every aspect of a system, with certain commands…
Quién la usa · con noticias en Jábega
Reglas Sigma para cazarla
- Linux Reverse Shell Indicatorcriticaltest · linux
- AWS EC2 Startup Shell Script Changehightest · aws
- Equation Group Indicatorshightest · linux
- JexBoss Command Sequencehightest · linux
- Shell Invocation via Env Command - Linuxhightest · linux
- Suspicious Activity in Shell Commandshightest · linux
- Suspicious Reverse Shell Command Linehightest · linux
- Axios NPM Compromise Indicators - Linuxhighexperimental · linux
- Axios NPM Compromise Indicators - macOShighexperimental · macos
- Script Interpreter Spawning Credential Scanner - Linuxhighexperimental · linux
- Suspicious Download and Execute Pattern via Curl/Wgethighexperimental · linux
- Suspicious Filename with Embedded Base64 Commandshighexperimental · linux
- BPFtrace Unsafe Option Usagemediumtest · linux
- Interactive Bash Suspicious Childrenmediumtest · linux
- Nohup Executionmediumtest · linux
- Suspicious Commands Linuxmediumtest · linux
- Potential Abuse of Linux Magic System Request Keymediumexperimental · linux
Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.