Cross-source coverage
T1059.004 / ATT&CK
Command and Scripting Interpreter: Unix Shell
349 rules across 7 sources.
20 deprecated hidden · include
From MITRE ATT&CK 19.2
Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution. Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.
Unix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops. Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems.
Adversaries may abuse Unix shells to execute various commands or payloads. Interactive shells may be accessed through command and control channels or during lateral movement such as with SSH. Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence.
Some systems, such as embedded devices, lightweight Linux distributions, and ESXi servers, may leverage stripped-down Unix shells via Busybox, a small executable that contains a variety of tools, including a simple shell.
- Tactics
- Execution
- Platforms
- ESXi · Linux · macOS · Network Devices
- Telemetry
-
auditd:SYSCALLlinux:osquerylinux:syslogmacos:unifiedlogmacos:osquerymacos:syslogesxi:vmkernelesxi:authnetworkdevice:syslogNSM:Flow
How MITRE says to detect it DET0384
Behavioral Detection of Unix Shell Execution
Linux Analytic 1081
Detects bash, sh, zsh, or BusyBox shell execution initiated via remote sessions, unauthorized users, or embedded within secondary script interpreters. Focus is on chained behavior: shell > suspicious commands > network discovery or persistence indicators.
auditd:SYSCALLexecvelinux:osquerysocket_eventslinux:syslogauth.log / secure.log
macOS Analytic 1082
Identifies use of sh/bash/zsh in suspicious context, such as user scripts launched from non-standard apps (e.g., Preview.app), embedded in LaunchDaemons, or executed outside Terminal.app. Looks for misuse in Automator, LaunchAgents, or NSAppleScript-executed shell.
macos:unifiedloglog stream --predicate 'eventMessage contains "exec"'macos:osquerylaunchd + process_eventsmacos:syslogsystem.log, asl.log
ESXi Analytic 1083
Detects BusyBox or Ash shell execution from unauthorized logins or remote connections. Focus is on rare shell invocations from DCUI, SSH sessions, or remote management paths. Also watches for payload droppers or persistence artifacts using shell.
esxi:vmkernelDCUI shell start, BusyBox activityesxi:authShell login or escalation
Network Devices Analytic 1084
Detects Unix shell usage on network appliances (e.g., routers, firewalls, embedded Linux) through rare console commands, CLI interfaces, or script injection via exposed APIs or SSH.
networkdevice:syslogCLI Command AuditNSM:Flowremote access
elastic/protections-artifacts
165 rules| Detection | Severity | Format |
|---|---|---|
| Abnormal Auval Child Process Execution | Undefined | Elastic TOML |
| Abnormally Large Shell Script Execution via Perl | Undefined | Elastic TOML |
| Attempt to establish VScode Remote Tunnel | Undefined | Elastic TOML |
| At Utility Launched through Udevadm | Undefined | Elastic TOML |
| Background Process Execution via Shell | Undefined | Elastic TOML |
| Background Task Execution via a Hidden Process | Undefined | Elastic TOML |
| Base64 or Xxd Decode Argument Evasion | Undefined | Elastic TOML |
| Base64 Shebang Payload Decoded via Built-in Utility | Undefined | Elastic TOML |
| Bind Shell via Netcat Traditional | Undefined | Elastic TOML |
| Bind Shell via Node | Undefined | Elastic TOML |
+ 155 more from elastic/protections-artifacts → showing the 10 highest-severity
elastic/detection-rules
141 rules| Detection | Severity | Format |
|---|---|---|
| Attempt to Install or Run Kali Linux via WSL | High | Elastic TOML |
| AWS SageMaker Notebook Lifecycle Configuration With Suspicious Script Content | High | Elastic TOML |
| Base64 Decoded Payload Piped to Interpreter | High | Elastic TOML |
| BPF filter applied using TC | High | Elastic TOML |
| Cupsd or Foomatic-rip Shell Execution | High | Elastic TOML |
| Curl Execution via Shell Profile | High | Elastic TOML |
| Decoded Payload Piped to Interpreter Detected via Defend for Containers | High | Elastic TOML |
| File Creation, Execution and Self-Deletion in Suspicious Directory | High | Elastic TOML |
| Ingress Tool Transfer Followed by Execution and Deletion Detected via Defend for Containers | High | Elastic TOML |
| Interactive Terminal Spawned via Perl | High | Elastic TOML |
+ 131 more from elastic/detection-rules → showing the 10 highest-severity
SigmaHQ/sigma
18 rules| Detection | Severity | Format |
|---|---|---|
| Linux Reverse Shell Indicator | Critical | Sigma |
| AWS EC2 Startup Shell Script Change | High | Sigma |
| Axios NPM Compromise Indicators - Linux | High | Sigma |
| Axios NPM Compromise Indicators - macOS | High | Sigma |
| Equation Group Indicators | High | Sigma |
| JexBoss Command Sequence | High | Sigma |
| Script Interpreter Spawning Credential Scanner - Linux | High | Sigma |
| Shell Invocation via Env Command - Linux | High | Sigma |
| Suspicious Activity in Shell Commands | High | Sigma |
| Suspicious Download and Execute Pattern via Curl/Wget | High | Sigma |
+ 8 more from SigmaHQ/sigma → showing the 10 highest-severity
socfortress/Wazuh-Rules
11 rules| Detection | Severity | Format |
|---|---|---|
| Change of login shell to /bin/sh (T1059.004) | High | Wazuh XML |
| Execution of privilege escalation scripts (AutoSUID, LinEnum) - T1059.004 | High | Wazuh XML |
| Execution of remote script via pipe-to-shell method (T1059.004) | High | Wazuh XML |
| Obfuscated base64-encoded payload piped to shell (T1059.004) | High | Wazuh XML |
| Script executed from hidden payload likely appended to image (Stego + Execution) | High | Wazuh XML |
| Shell creation using awk system call (T1059.004) | High | Wazuh XML |
| Shell spawned through emacs term (T1059.004) | High | Wazuh XML |
| Shell spawned via busybox (T1059.004) | High | Wazuh XML |
| Suspicious command used in possible steganographic payload delivery (T1001.002) | High | Wazuh XML |
| Suspicious use of curl or wget piped to shell (T1059.004) | High | Wazuh XML |
+ 1 more from socfortress/Wazuh-Rules → showing the 10 highest-severity
splunk/security_content
11 rules| Detection | Severity | Format |
|---|---|---|
| Linux Decode Base64 to Shell | Undefined | SPL |
| Linux Magic SysRq Key Abuse | Undefined | SPL |
| Linux MOTD Script Added | Undefined | SPL |
| Linux Netcat Outbound Connection | Undefined | SPL |
| Linux Possible System Binary Backdoor | Undefined | SPL |
| Linux Suspicious Privileged Container Execution | Undefined | SPL |
| Linux Suspicious React or Next.js Child Process | Undefined | SPL |
| Linux Suspicious XDG Autostart | Undefined | SPL |
| Linux Unix Shell Enable All SysRq Functions | Undefined | SPL |
| MacOS LOLbin | Undefined | SPL |
+ 1 more from splunk/security_content → showing the 10 highest-severity
falcosecurity/rules
2 rules| Detection | Severity | Format |
|---|---|---|
| Execution from /dev/shm | Medium | Falco YAML |
| Run shell untrusted | Low | Falco YAML |
Azure/Azure-Sentinel
1 rule| Detection | Severity | Format |
|---|---|---|
| RedMenshen-BPFDoor-backdoor | Undefined | KQL |