Command-Line Interface

Adversaries may utilize command-line interfaces (CLIs) to interact with systems and execute commands. CLIs provide a means of interacting with computer systems and are a common feature across many types of platforms and devices within control systems environments. [1] Adversaries may also use CLIs to install and run new software, including malicious tools that may be installed over the course of an operation.

CLIs are typically accessed locally, but can also be exposed via services, such as SSH, Telnet, and RDP. Commands that are executed in the CLI execute with the current permissions level of the process running the terminal emulator, unless the command specifies a change in permissions context. Many controllers have CLI interfaces for management purposes.

ID: T0807
Sub-techniques:  No sub-techniques
Tactic: Execution
Platforms: None
Version: 1.1
Created: 21 May 2020
Last Modified: 13 October 2023

Procedure Examples

ID Name Description
C0025 2016 Ukraine Electric Power Attack

During the 2016 Ukraine Electric Power Attack, Sandworm Team supplied the name of the payload DLL to Industroyer via a command line parameter.[2]

C0034 2022 Ukraine Electric Power Attack

During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged the SCIL-API on the MicroSCADA platform to execute commands through the scilc.exe binary.[3]

S0604 Industroyer

The name of the Industroyer payload DLL is supplied by the attackers via a command line parameter supplied in one of the main backdoors execute a shell command commands. [4]

G0034 Sandworm Team

Sandworm Team uses the MS-SQL server xp_cmdshell command, and PowerShell to execute commands. [5]

S0603 Stuxnet

Stuxnet will store and execute SQL code that will extract and execute Stuxnet from the saved CAB file using xp_cmdshell with the following command: set @s = master..xp _ cmdshell extrac32 /y +@t+ +@t+x; exec(@s); [6]

C0030 Triton Safety Instrumented System Attack

In the Triton Safety Instrumented System Attack, TEMP.Veles’ tool took one option from the command line, which was a single IP address of the target Triconex device.[7]

Targeted Assets

ID Asset
A0008 Application Server
A0007 Control Server
A0009 Data Gateway
A0006 Data Historian
A0002 Human-Machine Interface (HMI)
A0012 Jump Host
A0001 Workstation

Mitigations

ID Mitigation Description
M0942 Disable or Remove Feature or Program

Consider removing or restricting features that are unnecessary to an asset's intended function within the control environment.

M0938 Execution Prevention

Execution prevention may block malicious software from accessing protected resources through the command line interface.

Detection

ID Data Source Data Component Detects
DS0015 Application Log Application Log Content

Monitor logs from installed applications (e.g., historian logs) for unexpected commands or abuse of system features.

DS0017 Command Command Execution

On Windows and Unix systems monitor executed commands and arguments that may use shell commands for execution. Shells may be common on administrator, developer, or power user systems depending on job function.

On network device and embedded system CLIs consider reviewing command history if unauthorized or suspicious commands were used to modify device configuration.

DS0009 Process Process Creation

Monitor for processes spawning from known command shell applications (e.g., PowerShell, Bash). Benign activity will need to be allow-listed. This information can be useful in gaining additional insight to adversaries' actions through how they use native processes or custom tools.

References