| ID | Name |
|---|---|
| T1701.001 | PowerShell |
| T1701.002 | Windows Command Shell |
| T1701.003 | Unix Shell |
| T1701.004 | Visual Basic |
| T1701.005 | Python |
| T1701.006 | JavaScript |
Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution.[1][2] Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.
Unix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops. Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems.
Adversaries may abuse Unix shells to execute various commands or payloads. Interactive shells may be accessed through command and control channels or during lateral movement such as with Remote Services. Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence.
Within Industrial control system networks, workstations, control servers, hypervisors, networking devices, and embedded devices that run on linux platforms may allow for Unix command shell access or stripped-down shells to implement a subset of commands. Industrial automation equipment generally does not offer command shells as a native user interface.
| ID | Name | Description |
|---|---|---|
| C0063 | 2025 Poland Wiper Attacks |
During the 2025 Poland Wiper Attacks, the adversaries logged into the Mikronika RTUs via SSH, with root privileges, and executed Linux commands to delete all the files on the system resulting in device failure.[3] |
| S9046 | IOControl |
IOCONTROL has executed arbitrary commands using system calls as well as scripts with the UNIX Shell.[4] |
| ID | Mitigation | Description |
|---|---|---|
| M0938 | Execution Prevention |
Restrict interactive and scripted shell execution on Linux, network, and embedded ICS assets to approved accounts, management paths, commands, and vendor workflows. Where full application control is unavailable, constrain SSH/Telnet access and privileged shell use to dedicated administration paths. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0931 | Behavioral Detection of Unix Shell Execution in ICS | AN2088 |
Real-time monitoring identifies sh/bash/ash/zsh/BusyBox execution from an unexpected parent, unauthorized account, remote session, or non-approved script path, particularly when followed by OT-relevant network discovery, persistence, file modification, or communications. Alert only when the interpreter/shell is not expected for the asset role or user/service context, or when its parent, path, arguments, remote-session source, or follow-on behavior violates the approved OT baseline. Suppress approved engineering scripts, vendor support, diagnostics, backup, patching, and maintenance windows. |
| AN2089 |
Real-time monitoring identifies network-device CLI or underlying Unix-like shell access from an unauthorized management source/account, followed by privileged or configuration commands outside an approved change window. Do not alert solely on CLI use. Require violation of the management matrix, command authorization, or change-control context. |
||
| AN2090 |
Real-time monitoring identifies shell/CLI access to an embedded controller, gateway, HMI appliance, or IoT/OT device from an unauthorized source/account, or command execution that is inconsistent with the device role and approved maintenance workflow. Require a session/command authorization violation or corroborating configuration/firmware/process effect; do not infer maliciousness from deterministic timing alone. |