|T1059.003||Windows Command Shell|
|T1059.008||Network Device CLI|
Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux and macOS systems, though many variations of the Unix shell exist (e.g. sh, bash, zsh, etc.) depending on the specific OS or distribution. Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.
Unix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops. Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems.
Adversaries may abuse Unix shells to execute various commands or payloads. Interactive shells may be accessed through command and control channels or during lateral movement such as with SSH. Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence.
AppleJeus has used shell scripts to execute commands after installation and set persistence mechanisms.
Bundlore has leveraged /bin/sh and /bin/bash to execute commands on the victim machine.
CallMe has the capability to create a reverse shell on victims.
Chaos provides a reverse shell connection on 8338/TCP, encrypted via AES.
CoinTicker executes a bash script to establish a reverse shell.
CookieMiner has used a Unix shell script to run a series of commands targeting macOS.
Derusbi is capable of creating a remote Bash shell and executing commands.
Drovorub can execute arbitrary commands as root on a compromised system.
|S0401||Exaramel for Linux||
Exaramel for Linux has a command to execute a shell command on the system.
Fysbis has the ability to create and execute commands in a remote shell for CLI.
Green Lambert can use shell scripts for execution, such as
Kazuar uses /bin/bash to execute commands on the victim’s machine.
Kinsing has used Unix shell scripts to execute commands in the victim environment.
Kobalos can spawn a new pseudo-terminal and execute arbitrary commands at the command prompt.
LoudMiner used shell scripts to launch various services and to start/stop the QEMU virtualization.
MacMa can execute supplied shell commands and uses bash scripts to perform additional actions.
NETWIRE has the ability to use
OSX/Shlayer can use bash scripts to check the macOS version, download payloads, and extract bytes from files. OSX/Shlayer uses the command
OSX_OCEANLOTUS.D uses a shell script as the main executable inside an app bundle and drops an embedded base64-encoded payload to the
Proton uses macOS' .command file type to script actions.
Rocke used shell scripts to run commands which would obtain persistence and execute the cryptocurrency mining malware.
Skidmap has used
Turian has the ability to use
WindTail can use the
XCSSET uses a shell script to execute Mach-o files and
Use application control where appropriate.
|ID||Data Source||Data Component||Detects|
Monitor executed commands and arguments that may abuse Unix shell commands and scripts for execution. Unix shell usage may be common on administrator, developer, or power user systems, depending on job function. If scripting is restricted for normal users, then any attempt to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.
Monitor for newly executed processes that may abuse Unix shell commands and scripts for execution.