T1059.004 Command and Scripting Interpreter: Unix Shell

Adversaries may abuse Unix shell commands and scripts for execution. MITRE ATT&CK

184 programs on CmdID 9 Sigma rules T1059.004 on attack.mitre.org

Part of

MITRE ATT&CK

T1059Command and Scripting Interpreter

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules

aa-execshell agettyshell ansible-testshell aossshell aptshell apt-getshell asteriskshell atshell awkshell bashreverse-shell borgshell bpftraceshell bundleshell bundlershell busctlshell busyboxreverse-shell c89shell c99shell cabalshell ccshell cdistshell certbotshell check_by_sshshell check_ssl_certshell choomshell chrtshell clispshell cobcshell codereverse-shell codexshell composershell cpioshell cpulimitshell csvtoolshell ctrshell dcshell dhclientshell distccshell dmsetupshell doasshell dockershell dotnetshell dpkgshell dvipsshell easyrsashell emacsshell enscriptshell envshell exshell expectshell fastfetchshell findshell firejailshell flockshell forgeshell fzfshell g++shell gawkshell gccshell gdbshell gemshell genieshell ghcshell gitshell gnuplotshell gobind-shell grcshell gtestershell guileshell hgshell ioniceshell ipshell jrunscriptreverse-shell jtagshell juliareverse-shell kshreverse-shell ksushell kubectlshell latexshell latexmkshell ld.soshell lessshell lftpshell loginctlshell logrotateshell logsaveshell ltraceshell luabind-shell mailshell makeshell mawkshell minicomshell msgfiltershell multitimeshell mysqlshell nanoshell nawkshell ncbind-shell neofetchshell niceshell nmapshell nodebind-shell nohupshell npmshell nsentershell opensslreverse-shell openvpnshell opkgshell pdflatexshell pdftexshell perfshell perlreverse-shell perlbugshell pexecshell phpreverse-shell picshell picoshell pidstatshell pipshell pkexecshell plymouthshell podmanshell puppetshell rshell resticshell rlwrapshell rpmshell rpmdbshell rpmqueryshell rpmverifyshell rsyncshell rubyreverse-shell run-partsshell rustupshell scpshell scriptshell scrotshell sedshell setarchshell setlockshell sgshell slshshell socatbind-shell socketbind-shell softlimitshell splitshell sqlite3shell sshshell ssh-agentshell sshfsshell sshpassshell sshuttleshell start-stop-daemonshell stdbufshell straceshell sushell sudoshell systemctlshell systemd-runshell tarshell taskshell tasksetshell texshell timeshell timeoutshell tmateshell tmuxshell torifyshell torsocksshell unshareshell uvshell valgrindshell vishell watchshell wgetshell xargsshell xdg-user-dirshell xdotoolshell xelatexshell xetexshell yarnshell yt-dlpshell zipshell zshreverse-shell

Sigma rules tagged with it

process creation, the highest levels first

highAxios NPM Compromise Indicators - LinuxSwachchhanda Shrawan Poudel (Nextron Systems) · Linux

highAxios NPM Compromise Indicators - macOSSwachchhanda Shrawan Poudel (Nextron Systems) · macOS

highScript Interpreter Spawning Credential Scanner - LinuxSwachchhanda Shrawan Poudel (Nextron Systems) · Linux

highShell Invocation via Env Command - LinuxLi Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) · Linux

highSuspicious Download and Execute Pattern via Curl/WgetAayush Gupta · Linux

mediumBPFtrace Unsafe Option UsageAndreas Hunkeler (@Karneades) · Linux

mediumInteractive Bash Suspicious ChildrenFlorian Roth (Nextron Systems) · Linux

mediumNohup ExecutionChristopher Peacock @SecurePeacock, SCYTHE @scythe_io · Linux

mediumShell Spawned by Celery Worker ProcessJennifer Batina · Linux

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

reconnect to a running server, and turn on logging 3 levels of verbosity on the page for asterisk

asterisk -r -vvvIdentify

reconnect to a running server, run a single command, and return on the page for asterisk

asterisk -r -x "command"Identify

Show chan_SIP clients (phones) on the page for asterisk

asterisk -r -x "sip show peers"Identify

Install all gems defined in the Gemfile expected in the working directory on the page for bundle

bundle installIdentify

Run a process that can live beyond the terminal on the page for nohup

nohup command argument1 argument2 ...Identify

Launch nohup in background mode on the page for nohup

nohup command argument1 argument2 ... &Identify

Run a shell script that can live beyond the terminal on the page for nohup

nohup path/to/script.sh &Identify

Install a package on the page for opkg

opkg install packageIdentify

Run a shell with the x86_64 architecture on the page for setarch

setarch x86_64 bashIdentify

Generate completions for Bash on the page for pueue-completions

sudo pueue completions bash /usr/share/bash-completion/completions/pueue.bashIdentify

Generate completions for Zsh on the page for pueue-completions

sudo pueue completions zsh /usr/share/zsh/site-functionsIdentify

Specify a shell for running instead of the default shell (also works for login) on the page for runuser

sudo runuser user --shell /bin/shIdentify

And 6 more examples on CmdID’s program pages.

An example is here when CmdID’s reading of it names T1059.004: a Sigma rule it trips is tagged with it, or its abuse is documented as it.