t1059-004-unix-shell

name	T1059.004_unix-shell
description	Adversaries may abuse Unix shell commands and scripts for execution.
category	input-validation
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1059.004","execution","esxi","linux","macos","network-devices","sub-technique"]
technique_id	T1059.004
tactic	execution
all_tactics	["execution"]
platforms	["ESXi","Linux","macOS","Network Devices"]
mitre_url	https://attack.mitre.org/techniques/T1059/004
tech_stack	["esxi","linux","macos","network devices"]
cwe_ids	["CWE-94"]
chains_with	["T1059","T1059.001","T1059.002","T1059.003","T1059.005","T1059.006","T1059.007","T1059.008","T1059.009","T1059.010","T1059.011","T1059.012","T1059.013"]
prerequisites	["T1059"]
severity_boost	{"T1059":"Chain with T1059 for deeper attack path","T1059.001":"Chain with T1059.001 for deeper attack path","T1059.002":"Chain with T1059.002 for deeper attack path"}

T1059.004 Unix Shell

Sub-technique of: T1059

High-Level Description

Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution. Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.

Unix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops. Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems.

Adversaries may abuse Unix shells to execute various commands or payloads. Interactive shells may be accessed through command and control channels or during lateral movement such as with SSH. Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence.

Some systems, such as embedded devices, lightweight Linux distributions, and ESXi servers, may leverage stripped-down Unix shells via Busybox, a small executable that contains a variety of tools, including a simple shell.

Kill Chain Phase

• Execution (TA0002)

Platforms: ESXi, Linux, macOS, Network Devices

What to Check

• Identify if Unix Shell technique is applicable to target environment
• Check ESXi systems for indicators of Unix Shell
• Check Linux systems for indicators of Unix Shell
• Check macOS systems for indicators of Unix Shell
• Verify mitigations are bypassed or absent (1 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Create and Execute Bash Shell Script

Creates and executes a simple sh script.

Supported Platforms: linux, macos

sh -c "echo 'echo Hello from the Atomic Red Team' > #{script_path}"
sh -c 
 +x 
sh