Command and Scripting Interpreter: Unix Shell

Anchor can execute payloads via shell scripting.^[3]

AppleJeus has used shell scripts to execute commands after installation and set persistence mechanisms.^[4][5]

APT41 executed file /bin/pwd in activity exploiting CVE-2019-19781 against Citrix devices.^[6]

Bundlore has leveraged /bin/sh and /bin/bash to execute commands on the victim machine.^[7]

CallMe has the capability to create a reverse shell on victims.^[8]

Chaos provides a reverse shell connection on 8338/TCP, encrypted via AES.^[9]

COATHANGER provides a BusyBox reverse shell for command and control.^[10]

CoinTicker executes a bash script to establish a reverse shell.^[11]

CookieMiner has used a Unix shell script to run a series of commands targeting macOS.^[12]

Derusbi is capable of creating a remote Bash shell and executing commands.^[13][14]

Doki has executed shell scripts with /bin/sh.^[15]

Drovorub can execute arbitrary commands as root on a compromised system.^[16]

Exaramel for Linux has a command to execute a shell command on the system.^[17][18]

Fysbis has the ability to create and execute commands in a remote shell for CLI.^[19]

Green Lambert can use shell scripts for execution, such as /bin/sh -c.^[20][21]

Hildegard has used shell scripts for execution.^[22]

Kazuar uses /bin/bash to execute commands on the victim’s machine.^[23]

Kinsing has used Unix shell scripts to execute commands in the victim environment.^[24]

Kobalos can spawn a new pseudo-terminal and execute arbitrary commands at the command prompt.^[25]

LoudMiner used shell scripts to launch various services and to start/stop the QEMU virtualization.^[26]

MacMa can execute supplied shell commands and uses bash scripts to perform additional actions.^[27][28]

NETWIRE has the ability to use /bin/bash and /bin/sh to execute commands.^[29][30]

NKAbuse is initially installed and executed through an initial shell script.^[31]

OSX/Shlayer can use bash scripts to check the macOS version, download payloads, and extract bytes from files. OSX/Shlayer uses the command sh -c tail -c +1381... to extract bytes at an offset from a specified file. OSX/Shlayer uses the curl -fsL "$url" >$tmp_path command to download malicious payloads into a temporary directory.^{[32][33][34][35]}

OSX_OCEANLOTUS.D uses a shell script as the main executable inside an app bundle and drops an embedded base64-encoded payload to the /tmp folder.^[36][37]

PACEMAKER can use a simple bash script for execution.^[38]

Penquin can execute remote commands using bash scripts.^[39]

PITSTOP has the ability to receive shell commands over a Unix domain socket.^[40]

Proton uses macOS' .command file type to script actions.^[41]

PULSECHECK can use Unix shell script for command execution.^[38]

Rocke used shell scripts to run commands which would obtain persistence and execute the cryptocurrency mining malware.^[42]

Skidmap has used pm.sh to download and install its main payload.^[43]

TeamTNT has used shell scripts for execution.^[44][45]

Turian has the ability to use /bin/sh to execute commands.^[46]

WindTail can use the open command to execute an application.^[47]

XCSSET uses a shell script to execute Mach-o files and osacompile commands such as, osacompile -x -o xcode.app main.applescript.^[48]

ZIPLINE can use /bin/sh to create a reverse shell and execute commands.^[49]

Use application control where appropriate.