Command and Scripting Interpreter: Unix Shell

Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux and macOS systems, though many variations of the Unix shell exist (e.g. sh, bash, zsh, etc.) depending on the specific OS or distribution.[1][2] Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.

Unix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops. Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems.

Adversaries may abuse Unix shells to execute various commands or payloads. Interactive shells may be accessed through command and control channels or during lateral movement such as with SSH. Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence.

ID: T1059.004
Sub-technique of:  T1059
Tactic: Execution
Platforms: Linux, Network, macOS
Supports Remote:  Yes
Version: 1.2
Created: 09 March 2020
Last Modified: 16 April 2024

Procedure Examples

ID Name Description
S0504 Anchor

Anchor can execute payloads via shell scripting.[3]

S0584 AppleJeus

AppleJeus has used shell scripts to execute commands after installation and set persistence mechanisms.[4][5]

G0096 APT41

APT41 executed file /bin/pwd in activity exploiting CVE-2019-19781 against Citrix devices.[6]

S0482 Bundlore

Bundlore has leveraged /bin/sh and /bin/bash to execute commands on the victim machine.[7]

S0077 CallMe

CallMe has the capability to create a reverse shell on victims.[8]

S0220 Chaos

Chaos provides a reverse shell connection on 8338/TCP, encrypted via AES.[9]


COATHANGER provides a BusyBox reverse shell for command and control.[10]

S0369 CoinTicker

CoinTicker executes a bash script to establish a reverse shell.[11]

S0492 CookieMiner

CookieMiner has used a Unix shell script to run a series of commands targeting macOS.[12]

S0021 Derusbi

Derusbi is capable of creating a remote Bash shell and executing commands.[13][14]

S0600 Doki

Doki has executed shell scripts with /bin/sh.[15]

S0502 Drovorub

Drovorub can execute arbitrary commands as root on a compromised system.[16]

S0401 Exaramel for Linux

Exaramel for Linux has a command to execute a shell command on the system.[17][18]

S0410 Fysbis

Fysbis has the ability to create and execute commands in a remote shell for CLI.[19]

S0690 Green Lambert

Green Lambert can use shell scripts for execution, such as /bin/sh -c.[20][21]

S0601 Hildegard

Hildegard has used shell scripts for execution.[22]

S0265 Kazuar

Kazuar uses /bin/bash to execute commands on the victim’s machine.[23]

S0599 Kinsing

Kinsing has used Unix shell scripts to execute commands in the victim environment.[24]

S0641 Kobalos

Kobalos can spawn a new pseudo-terminal and execute arbitrary commands at the command prompt.[25]

S0451 LoudMiner

LoudMiner used shell scripts to launch various services and to start/stop the QEMU virtualization.[26]

S1016 MacMa

MacMa can execute supplied shell commands and uses bash scripts to perform additional actions.[27][28]


NETWIRE has the ability to use /bin/bash and /bin/sh to execute commands.[29][30]

S1107 NKAbuse

NKAbuse is initially installed and executed through an initial shell script.[31]

S0402 OSX/Shlayer

OSX/Shlayer can use bash scripts to check the macOS version, download payloads, and extract bytes from files. OSX/Shlayer uses the command sh -c tail -c +1381... to extract bytes at an offset from a specified file. OSX/Shlayer uses the curl -fsL "$url" >$tmp_path command to download malicious payloads into a temporary directory.[32][33][34][35]


OSX_OCEANLOTUS.D uses a shell script as the main executable inside an app bundle and drops an embedded base64-encoded payload to the /tmp folder.[36][37]


PACEMAKER can use a simple bash script for execution.[38]

S0587 Penquin

Penquin can execute remote commands using bash scripts.[39]


PITSTOP has the ability to receive shell commands over a Unix domain socket.[40]

S0279 Proton

Proton uses macOS' .command file type to script actions.[41]


PULSECHECK can use Unix shell script for command execution.[38]

G0106 Rocke

Rocke used shell scripts to run commands which would obtain persistence and execute the cryptocurrency mining malware.[42]

S0468 Skidmap

Skidmap has used to download and install its main payload.[43]

G0139 TeamTNT

TeamTNT has used shell scripts for execution.[44][45]

S0647 Turian

Turian has the ability to use /bin/sh to execute commands.[46]

S0466 WindTail

WindTail can use the open command to execute an application.[47]


XCSSET uses a shell script to execute Mach-o files and osacompile commands such as, osacompile -x -o main.applescript.[48]


ZIPLINE can use /bin/sh to create a reverse shell and execute commands.[49]


ID Mitigation Description
M1038 Execution Prevention

Use application control where appropriate.


ID Data Source Data Component Detects
DS0017 Command Command Execution

Monitor executed commands and arguments that may abuse Unix shell commands and scripts for execution. Unix shell usage may be common on administrator, developer, or power user systems, depending on job function. If scripting is restricted for normal users, then any attempt to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.

Note: this analytic does not include an exhaustive list of potentially suspicious commands that could be executed through a shell interpreter. Instead, it is meant to serve as an example of types of commands that can warrant further investigation.

Analytic 1 - Unusual command execution

source="Linux:" CommandLine="sh -c" AND (CommandLine="wget" OR CommandLine="curl" OR CommandLine="nc" OR CommandLine="perl")

DS0009 Process Process Creation

Monitor for newly executed processes that may abuse Unix shell commands and scripts for execution.


  1. (n.d.). bash(1) - Linux man page. Retrieved June 12, 2020.
  2. Apple. (2020, January 28). Use zsh as the default shell on your Mac. Retrieved June 12, 2020.
  3. Grange, W. (2020, July 13). Anchor_dns malware goes cross platform. Retrieved September 10, 2020.
  4. Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.
  5. Patrick Wardle. (2019, October 12). Pass the AppleJeus. Retrieved September 28, 2022.
  6. Glyer, C, et al. (2020, March). This Is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits. Retrieved April 28, 2020.
  7. Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.
  8. Falcone, R. and Miller-Osborn, J.. (2016, January 24). Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists. Retrieved February 10, 2016.
  9. Sebastian Feldmann. (2018, February 14). Chaos: a Stolen Backdoor Rising Again. Retrieved March 5, 2018.
  10. Dutch Military Intelligence and Security Service (MIVD) & Dutch General Intelligence and Security Service (AIVD). (2024, February 6). Ministry of Defense of the Netherlands uncovers COATHANGER, a stealthy Chinese FortiGate RAT. Retrieved February 7, 2024.
  11. Thomas Reed. (2018, October 29). Mac cryptocurrency ticker app installs backdoors. Retrieved April 23, 2019.
  12. Chen, y., et al. (2019, January 31). Mac Malware Steals Cryptocurrency Exchanges’ Cookies. Retrieved July 22, 2020.
  13. Fidelis Cybersecurity. (2016, February 29). The Turbo Campaign, Featuring Derusbi for 64-bit Linux. Retrieved March 2, 2016.
  14. FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.
  15. Fishbein, N., Kajiloti, M.. (2020, July 28). Watch Your Containers: Doki Infecting Docker Servers in the Cloud. Retrieved March 30, 2021.
  16. NSA/FBI. (2020, August). Russian GRU 85th GTsSS Deploys Previously Undisclosed Drovorub Malware. Retrieved August 25, 2020.
  17. Cherepanov, A., Lipovsky, R. (2018, October 11). New TeleBots backdoor: First evidence linking Industroyer to NotPetya. Retrieved November 27, 2018.
  19. Bryan Lee and Rob Downs. (2016, February 12). A Look Into Fysbis: Sofacy’s Linux Backdoor. Retrieved September 10, 2017.
  20. Sandvik, Runa. (2021, October 1). Made In America: Green Lambert for OS X. Retrieved March 21, 2022.
  21. Sandvik, Runa. (2021, October 18). Green Lambert and ATT&CK. Retrieved March 21, 2022.
  22. Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.
  23. Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.
  24. Singer, G. (2020, April 3). Threat Alert: Kinsing Malware Attacks Targeting Container Environments. Retrieved April 1, 2021.
  25. M.Leveille, M., Sanmillan, I. (2021, February 2). Kobalos – A complex Linux threat to high performance computing infrastructure. Retrieved August 24, 2021.
  1. Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.
  2. M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.
  3. Wardle, P. (2021, November 11). OSX.CDDS (OSX.MacMa). Retrieved June 30, 2022.
  4. Lambert, T. (2020, January 29). Intro to Netwire. Retrieved January 7, 2021.
  5. Proofpoint. (2020, December 2). Geofenced NetWire Campaigns. Retrieved January 7, 2021.
  6. KASPERSKY GERT. (2023, December 14). Unveiling NKAbuse: a new multiplatform threat abusing the NKN protocol. Retrieved February 8, 2024.
  7. Carbon Black Threat Analysis Unit. (2019, February 12). New macOS Malware Variant of Shlayer (OSX) Discovered. Retrieved August 8, 2019.
  8. Phil Stokes. (2020, September 8). Coming Out of Your Shell: From Shlayer to ZShlayer. Retrieved September 13, 2021.
  9. Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.
  10. Patrick Wardle. (2020, August 30). Apple Approved Malware malicious code notarized!? #2020. Retrieved September 13, 2021.
  11. Magisa, L. (2020, November 27). New MacOS Backdoor Connected to OceanLotus Surfaces. Retrieved December 2, 2020.
  12. Phil Stokes. (2020, December 2). APT32 Multi-stage macOS Trojan Innovates on Crimeware Scripting Technique. Retrieved September 13, 2021.
  13. Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024.
  14. Leonardo. (2020, May 29). MALWARE TECHNICAL INSIGHT TURLA “Penquin_x64”. Retrieved March 11, 2021.
  15. Lin, M. et al. (2024, February 27). Cutting Edge, Part 3: Investigating Ivanti Connect Secure VPN Exploitation and Persistence Attempts. Retrieved March 1, 2024.
  16. Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.
  17. Liebenberg, D.. (2018, August 30). Rocke: The Champion of Monero Miners. Retrieved May 26, 2020.
  18. Remillano, A., Urbanec, J. (2019, September 19). Skidmap Linux Malware Uses Rootkit Capabilities to Hide Cryptocurrency-Mining Payload. Retrieved June 4, 2020.
  19. Fiser, D. Oliveira, A. (n.d.). Tracking the Activities of TeamTNT A Closer Look at a Cloud-Focused Malicious Actor Group. Retrieved September 22, 2021.
  20. Darin Smith. (2022, April 21). TeamTNT targeting AWS, Alibaba. Retrieved August 4, 2022.
  21. Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021
  22. Wardle, Patrick. (2018, December 20). Middle East Cyber-Espionage analyzing WindShift's implant: OSX.WindTail (part 1). Retrieved October 3, 2019.
  23. Mac Threat Response, Mobile Research Team. (2020, August 13). The XCSSET Malware: Inserts Malicious Code Into Xcode Projects, Performs UXSS Backdoor Planting in Safari, and Leverages Two Zero-day Exploits. Retrieved October 5, 2021.
  24. McLellan, T. et al. (2024, January 12). Cutting Edge: Suspected APT Targets Ivanti Connect Secure VPN in New Zero-Day Exploitation. Retrieved February 27, 2024.