Detection of Unix Shell

Technique Detected:  Unix Shell | T1623.001

ID: DET0607
Domains: Mobile
Analytics: AN1657, AN1658
Version: 1.0
Created: 21 October 2025
Last Modified: 21 October 2025

Analytics

AN1657

Command-line activities can potentially be detected through Mobile Threat Defense (MTD) integrations with lower-level OS APIs. This could grant the MTD agents access to running processes and their parameters, potentially detecting unwanted or malicious shells.
Mobile Threat Defense (MTD) with lower-level OS APIs integrations may have access to newly created processes and their parameters, potentially detecting unwanted or malicious shells.
Application vetting services could detect the invocations of methods that could be used to execute shell commands.[1]
Mobile Threat Defense (MTD) with lower-level OS APIs integrations may have access to running processes and their parameters, potentially detecting unwanted or malicious shells.

Log Sources
Data Component Name Channel
Command Execution (DC0064) Command None
Process Creation (DC0032) Process None
API Calls (DC0112) Application Vetting None
Process Metadata (DC0034) Process None

AN1658

Command-line activities can potentially be detected through Mobile Threat Defense (MTD) integrations with lower-level OS APIs. This could grant the MTD agents access to running processes and their parameters, potentially detecting unwanted or malicious shells.
Mobile Threat Defense (MTD) with lower-level OS APIs integrations may have access to newly created processes and their parameters, potentially detecting unwanted or malicious shells.
Application vetting services could detect the invocations of methods that could be used to execute shell commands.[1]
Mobile Threat Defense (MTD) with lower-level OS APIs integrations may have access to running processes and their parameters, potentially detecting unwanted or malicious shells.

Log Sources
Data Component Name Channel
Command Execution (DC0064) Command None
Process Creation (DC0032) Process None
API Calls (DC0112) Application Vetting None
Process Metadata (DC0034) Process None

References