Command and Scripting Interpreter: Unix Shell

Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux and macOS systems, though many variations of the Unix shell exist (e.g. sh, bash, zsh, etc.) depending on the specific OS or distribution.[1][2] Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.

Adversaries may abuse Unix shells to execute various commands or payloads. Interactive shells may be accessed through command and control channels or during lateral movement such as with SSH. Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence.[3]

Procedure Examples

Name Description
APT41

APT41 executed file /bin/pwd in activity exploiting CVE-2019-19781 against Citrix devices.[4]

Rocke

Rocke used shell scripts to run commands which would obtain persistence and execute the cryptocurrency mining malware.[5]

Skidmap

Skidmap has used pm.sh to download and install its main payload.[6]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection

Unix shell usage may be common on administrator, developer, or power user systems, depending on job function. If scripting is restricted for normal users, then any attempt to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.

Scripts are likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for script execution and subsequent behavior. Actions may be related to network and system information discovery, collection, or other scriptable post-compromise behaviors and could be used as indicators of detection leading back to the source script.

References

Attachments

ID
VT0012.001
Sub-techniques
Tactic
Execution
Platforms
Linux
macOS
Permissions Required
User
root
Data Sources
File monitoring
Process command-line parameters
Process monitoring
Version
1.0

Created: 21 December 2020

Last Modified: 21 December 2020