Command and Scripting Interpreter: Unix Shell

Anchor can execute payloads via shell scripting.^[3]

AppleJeus has used shell scripts to execute commands after installation and set persistence mechanisms.^[4][5]

APT41 used Linux shell commands for system survey and information gathering prior to exploitation of vulnerabilities such as CVE-2019-19871.^[6]

Aquatic Panda used malicious shell scripts in Linux environments following access via SSH to install Linux versions of Winnti malware.^[7]

BPFDoor can create a reverse shell and supports vt100 emulator formatting.^[8]

Bundlore has leveraged /bin/sh and /bin/bash to execute commands on the victim machine.^[9]

CallMe has the capability to create a reverse shell on victims.^[10]

Chaos provides a reverse shell connection on 8338/TCP, encrypted via AES.^[11]

COATHANGER provides a BusyBox reverse shell for command and control.^[12]

CoinTicker executes a bash script to establish a reverse shell.^[13]

CookieMiner has used a Unix shell script to run a series of commands targeting macOS.^[14]

Cuckoo Stealer can spawn a bash shell to enable execution on compromised hosts.^[15]

Derusbi is capable of creating a remote Bash shell and executing commands.^[16][17]

Doki has executed shell scripts with /bin/sh.^[18]

Drovorub can execute arbitrary commands as root on a compromised system.^[19]

Ebury can use the commands Xcsh or Xcls to open a shell with Ebury level permissions and Xxsh to open a shell with root level.^[20]

Exaramel for Linux has a command to execute a shell command on the system.^[21][22]

Fysbis has the ability to create and execute commands in a remote shell for CLI.^[23]

Green Lambert can use shell scripts for execution, such as /bin/sh -c.^[24][25]

Hildegard has used shell scripts for execution.^[26]

Kazuar uses /bin/bash to execute commands on the victim’s machine.^[27]

Kinsing has used Unix shell scripts to execute commands in the victim environment.^[28]

Kobalos can spawn a new pseudo-terminal and execute arbitrary commands at the command prompt.^[29]

KV Botnet Activity utilizes multiple Bash scripts during botnet installation stages, and the final botnet payload allows for running commands in the Bash shell.^[30]

LoudMiner used shell scripts to launch various services and to start/stop the QEMU virtualization.^[31]

MacMa can execute supplied shell commands and uses bash scripts to perform additional actions.^[32][33]

NETWIRE has the ability to use /bin/bash and /bin/sh to execute commands.^[34][35]

NKAbuse is initially installed and executed through an initial shell script.^[36]

OSX/Shlayer can use bash scripts to check the macOS version, download payloads, and extract bytes from files. OSX/Shlayer uses the command sh -c tail -c +1381... to extract bytes at an offset from a specified file. OSX/Shlayer uses the curl -fsL "$url" >$tmp_path command to download malicious payloads into a temporary directory.^{[37][38][39][40]}

OSX_OCEANLOTUS.D uses a shell script as the main executable inside an app bundle and drops an embedded base64-encoded payload to the /tmp folder.^[41][42]

PACEMAKER can use a simple bash script for execution.^[43]

Penquin can execute remote commands using bash scripts.^[44]

PITSTOP has the ability to receive shell commands over a Unix domain socket.^[45]

Proton uses macOS' .command file type to script actions.^[46]

PULSECHECK can use Unix shell script for command execution.^[43]

Rocke used shell scripts to run commands which would obtain persistence and execute the cryptocurrency mining malware.^[47]

Skidmap has used pm.sh to download and install its main payload.^[48]

TeamTNT has used shell scripts for execution.^[49][50]

Turian has the ability to use /bin/sh to execute commands.^[51]

Volt Typhoon has used Brightmetricagent.exe which contains a command- line interface (CLI) library that can leverage command shells including Z Shell (zsh).^[52]

WindTail can use the open command to execute an application.^[53]

XCSSET uses a shell script to execute Mach-o files and osacompile commands such as, osacompile -x -o xcode.app main.applescript.^[54]

ZIPLINE can use /bin/sh to create a reverse shell and execute commands.^[55]

Use application control where appropriate.