CmdID

CmdID / Commands

sh

Bourne shell, the standard command language interpreter. tldr-pages

On several platforms 14 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Several platforms

from tldr-pages, CC BY 4.0

Start an interactive shell session

Execute a command and then exit

sh -c "command"Identify

Execute a script

sh path/to/script.shIdentify

Read and execute commands from stdin

What detects it

Sigma process creation rules that name sh
highKaspersky Endpoint Security Stopped Via CommandLine - LinuxMilad Cheraghi
highLinux Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali
highPotential WizardUpdate Malware InfectionTim Rauch (rule), Elastic (idea)
highShell Execution Of Process Located In Tmp DirectoryJoseliyo Sanchez, @Joseliyo_Jstnk
highSuspicious Invocation of Shell via RsyncFlorian Roth
highSuspicious Microsoft Office Child Process - MacOSSohan G (D4rkCiph3r)
mediumExecution Of Script Located In Potentially Suspicious DirectoryJoseliyo Sanchez, @Joseliyo_Jstnk
mediumJAMF MDM Potential Suspicious Child ProcessNasreddine Bencherchali (Nextron Systems)
mediumPotential Exploitation of CVE-2025-5054 or CVE-2025-4598Milad Cheraghi
mediumShell Spawned by Celery Worker ProcessJennifer Batina
mediumSuspicious Browser Child Process - MacOSSohan G (D4rkCiph3r)
mediumSuspicious Child Process of SAP NetWeaver - LinuxElastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems)
mediumSuspicious Execution via macOS Script EditorTim Rauch (rule), Elastic (idea)
mediumSuspicious Installer Package Child ProcessSohan G (D4rkCiph3r)