Command and Scripting Interpreter: Unix Shell

Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux and macOS systems, though many variations of the Unix shell exist (e.g. sh, bash, zsh, etc.) depending on the specific OS or distribution.[1][2] Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.

Unix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops. Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems.

Adversaries may abuse Unix shells to execute various commands or payloads. Interactive shells may be accessed through command and control channels or during lateral movement such as with SSH. Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence.

ID: T1059.004
Sub-technique of:  T1059
Tactic: Execution
Platforms: Linux, macOS
Permissions Required: User, root
Data Sources: File monitoring, Process command-line parameters, Process monitoring
Version: 1.0
Created: 09 March 2020
Last Modified: 15 June 2020

Procedure Examples

Name Description
APT41

APT41 executed file /bin/pwd in activity exploiting CVE-2019-19781 against Citrix devices.[17]

Bundlore

Bundlore has leveraged /bin/sh and /bin/bash to execute commands on the victim machine.[16]

CallMe

CallMe has the capability to create a reverse shell on victims.[3]

Chaos

Chaos provides a reverse shell connection on 8338/TCP, encrypted via AES.[4]

CoinTicker

CoinTicker executes a bash script to establish a reverse shell.[9]

Derusbi

Derusbi is capable of creating a remote Bash shell and executing commands.[5][6]

Exaramel for Linux

Exaramel for Linux has a command to execute a shell command on the system.[10]

Fysbis

Fysbis has the ability to create and execute commands in a remote shell for CLI.[12]

Kazuar

Kazuar uses /bin/bash to execute commands on the victim’s machine.[7]

LoudMiner

LoudMiner used shell scripts to launch various services and to start/stop the QEMU virtualization.[13]

OSX/Shlayer

OSX/Shlayer can use bash scripts to check the macOS version and download payloads.[11]

Proton

Proton uses macOS' .command file type to script actions.[8]

Rocke

Rocke used shell scripts to run commands which would obtain persistence and execute the cryptocurrency mining malware.[18]

Skidmap

Skidmap has used pm.sh to download and install its main payload.[14]

WindTail

WindTail can use the open command to execute an application.[15]

Mitigations

Mitigation Description
Execution Prevention

Use application control where appropriate.

Detection

Unix shell usage may be common on administrator, developer, or power user systems, depending on job function. If scripting is restricted for normal users, then any attempt to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.

Scripts are likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for script execution and subsequent behavior. Actions may be related to network and system information discovery, collection, or other scriptable post-compromise behaviors and could be used as indicators of detection leading back to the source script.

References