Detection of Command and Scripting Interpreter

ID: DET0655
Domains: Mobile
Analytics: AN1741, AN1742
Version: 1.0
Created: 21 October 2025
Last Modified: 21 October 2025

Analytics

AN1741

Command-line activities can potentially be detected through Mobile Threat Defense (MTD) integrations with lower-level OS APIs. This could grant the MTD agents access to running processes and their parameters, potentially detecting unwanted or malicious shells.
Mobile Threat Defense (MTD) with lower-level OS APIs integrations may have access to newly created processes and their parameters, potentially detecting unwanted or malicious shells.
Application vetting services could detect the invocations of methods that could be used to execute shell commands.[1]
Mobile Threat Defense (MTD) with lower-level OS APIs integrations may have access to running processes and their parameters, potentially detecting unwanted or malicious shells.

Log Sources
Data Component Name Channel
Command Execution (DC0064) Command None
Process Creation (DC0032) Process None
API Calls (DC0112) Application Vetting None
Process Metadata (DC0034) Process None

AN1742

Command-line activities can potentially be detected through Mobile Threat Defense (MTD) integrations with lower-level OS APIs. This could grant the MTD agents access to running processes and their parameters, potentially detecting unwanted or malicious shells.
Mobile Threat Defense (MTD) with lower-level OS APIs integrations may have access to newly created processes and their parameters, potentially detecting unwanted or malicious shells.
Application vetting services could detect the invocations of methods that could be used to execute shell commands.[1]
Mobile Threat Defense (MTD) with lower-level OS APIs integrations may have access to running processes and their parameters, potentially detecting unwanted or malicious shells.

Log Sources
Data Component Name Channel
Command Execution (DC0064) Command None
Process Creation (DC0032) Process None
API Calls (DC0112) Application Vetting None
Process Metadata (DC0034) Process None

References