Command Execution

Command Execution involves monitoring and capturing the execution of textual commands (including shell commands, cmdlets, and scripts) within an operating system or application. These commands may include arguments or parameters and are typically executed through interpreters such as cmd.exe, bash, zsh, PowerShell, or programmatic execution. Examples:

• Windows Command Prompt
  • dir – Lists directory contents.
  • net user – Queries or manipulates user accounts.
  • tasklist – Lists running processes.
• PowerShell
  • Get-Process – Retrieves processes running on a system.
  • Set-ExecutionPolicy – Changes PowerShell script execution policies.
  • Invoke-WebRequest – Downloads remote resources.
• Linux Shell
  • ls – Lists files in a directory.
  • cat /etc/passwd – Reads the user accounts file.
  • curl http://malicious-site.com – Retrieves content from a malicious URL.
• Container Environments
  • docker exec – Executes a command inside a running container.
  • kubectl exec – Runs commands in Kubernetes pods.
• macOS Terminal
  • open – Opens files or URLs.
  • dscl . -list /Users – Lists all users on the system.
  • osascript -e – Executes AppleScript commands.

This data component can be collected through the following measures:

Enable Command Logging

• Windows:
  • Enable PowerShell logging: Set-ExecutionPolicy Bypass, Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name EnableScriptBlockLogging -Value 1
  • Enable Windows Event Logging:
    • Event ID 4688: Tracks process creation, including command-line arguments.
    • Event ID 4104: Logs PowerShell script block execution.
• Linux/macOS:
  • Enable shell history logging in .bashrc or .zshrc: export HISTTIMEFORMAT="%d/%m/%y %T ", export PROMPT_COMMAND='history -a; history -w'
  • Use audit frameworks (e.g., auditd) to log command executions. Example rule to log all execve syscalls: -a always,exit -F arch=b64 -S execve -k cmd_exec
• Containers:
  • Use runtime-specific tools like Docker’s --log-driver or Kubernetes Audit Logs to capture exec commands.

Integrate with Centralized Logging

• Collect logs using a SIEM (e.g., Splunk) or cloud-based log aggregation tools like AWS CloudWatch or Azure Monitor. Example Splunk Search for Windows Event 4688:
  index=windows EventID=4688 CommandLine=*

Use Endpoint Detection and Response (EDR) Tools

• Monitor command executions via EDR solutions

Deploy Sysmon for Advanced Logging (Windows)

• Use Sysmon's Event ID 1 to log process creation with command-line arguments