T1059.004: Unix Shell

Description

Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution.(Citation: DieNet Bash)(Citation: Apple ZShell) Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.

Unix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops. Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems.

Adversaries may abuse Unix shells to execute various commands or payloads. Interactive shells may be accessed through command and control channels or during lateral movement such as with SSH. Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence.

Some systems, such as embedded devices, lightweight Linux distributions, and ESXi servers, may leverage stripped-down Unix shells via Busybox, a small executable that contains a variety of tools, including a simple shell.

☞

Reverse Shell Cheatsheet

Read our in-depth pentesting guide related to this technique

Platforms

Mitigations (1)

Threat Groups (11)

ID	Group	Context
G1017	Volt Typhoon	[Volt Typhoon](https://attack.mitre.org/groups/G1017) has used Brightmetricagent.exe which contains a command- line interface (CLI) library that can l...
G0096	APT41	[APT41](https://attack.mitre.org/groups/G0096) used Linux shell commands for system survey and information gathering prior to exploitation of vulnerab...
G0139	TeamTNT	[TeamTNT](https://attack.mitre.org/groups/G0139) has used shell scripts for execution.(Citation: Trend Micro TeamTNT)(Citation: Cisco Talos Intelligen...
G0106	Rocke	[Rocke](https://attack.mitre.org/groups/G0106) used shell scripts to run commands which would obtain persistence and execute the cryptocurrency mining...
G1015	Scattered Spider	[Scattered Spider](https://attack.mitre.org/groups/G1015) has used the command shell to upload and install the Teleport remote access tool to a compro...
G1048	UNC3886	[UNC3886](https://attack.mitre.org/groups/G1048) has used a bash script to install malicious vSphere Installation Bundles (VIBs).(Citation: Google Cl...
G1052	Contagious Interview	[Contagious Interview](https://attack.mitre.org/groups/G1052) has targeted macOS victim hosts using a bash downloader coremedia.sh and a bash script c...
G1041	Sea Turtle	[Sea Turtle](https://attack.mitre.org/groups/G1041) used shell scripts for post-exploitation execution in victim environments.(Citation: PWC Sea Turtl...
G0143	Aquatic Panda	[Aquatic Panda](https://attack.mitre.org/groups/G0143) used malicious shell scripts in Linux environments following access via SSH to install Linux ve...
G1047	Velvet Ant	[Velvet Ant](https://attack.mitre.org/groups/G1047) used a custom tool, VELVETSTING, to parse encoded inbound commands to compromised F5 BIG-IP device...
G1056	TeamPCP	[TeamPCP](https://attack.mitre.org/groups/G1056) has leveraged malware capable of execution via the Linux CLI.(Citation: Hunt.io TeamPCP Toolkit MAY 2...

Associated Software (49)

ID	Name	Type	Context
S9015	BRICKSTORM	Malware	[BRICKSTORM](https://attack.mitre.org/software/S9015) has executed shell commands using `/bin/sh`.(Citation: Google UNC5221 BRICKSTORM SPAWNCHIMERA Ap...
S1105	COATHANGER	Malware	[COATHANGER](https://attack.mitre.org/software/S1105) provides a BusyBox reverse shell for command and control.(Citation: NCSC-NL COATHANGER Feb 2024)
S0466	WindTail	Malware	[WindTail](https://attack.mitre.org/software/S0466) can use the <code>open</code> command to execute an application.(Citation: objective-see windtail1...
S0401	Exaramel for Linux	Malware	[Exaramel for Linux](https://attack.mitre.org/software/S0401) has a command to execute a shell command on the system.(Citation: ESET TeleBots Oct 2018...
S1224	CASTLETAP	Malware	[CASTLETAP](https://attack.mitre.org/software/S1224) has the ability to spawn BusyBox command shell in victim environments.(Citation: Mandiant Fortine...
S0198	NETWIRE	Malware	[NETWIRE](https://attack.mitre.org/software/S0198) has the ability to use <code>/bin/bash</code> and <code>/bin/sh</code> to execute commands.(Citatio...
S1203	J-magic	Malware	The [J-magic](https://attack.mitre.org/software/S1203) agent is executed through a command line argument which specifies an interface and listening po...
S1198	Gomir	Malware	[Gomir](https://attack.mitre.org/software/S1198) reads command line arguments and parses them for functionality when executed from a Linux shell, and ...
S1184	BOLDMOVE	Malware	[BOLDMOVE](https://attack.mitre.org/software/S1184) is capable of spawning a remote command shell.(Citation: Google Cloud BOLDMOVE 2023)
S0647	Turian	Malware	[Turian](https://attack.mitre.org/software/S0647) has the ability to use <code>/bin/sh</code> to execute commands.(Citation: ESET BackdoorDiplomacy Ju...
S0601	Hildegard	Malware	[Hildegard](https://attack.mitre.org/software/S0601) has used shell scripts for execution.(Citation: Unit 42 Hildegard Malware)
S1153	Cuckoo Stealer	Malware	[Cuckoo Stealer](https://attack.mitre.org/software/S1153) can spawn a bash shell to enable execution on compromised hosts.(Citation: Kandji Cuckoo Apr...
S0468	Skidmap	Malware	[Skidmap](https://attack.mitre.org/software/S0468) has used <code>pm.sh</code> to download and install its main payload.(Citation: Trend Micro Skidmap...
S1219	REPTILE	Malware	[REPTILE](https://attack.mitre.org/software/S1219) can deploy components automatically with shell scripts.(Citation: Google Cloud Mandiant UNC3886 202...
S0600	Doki	Malware	[Doki](https://attack.mitre.org/software/S0600) has executed shell scripts with /bin/sh.(Citation: Intezer Doki July 20)
S0410	Fysbis	Malware	[Fysbis](https://attack.mitre.org/software/S0410) has the ability to create and execute commands in a remote shell for CLI.(Citation: Fysbis Palo Alto...
S0265	Kazuar	Malware	[Kazuar](https://attack.mitre.org/software/S0265) uses /bin/bash to execute commands on the victim’s machine.(Citation: Unit 42 Kazuar May 2017)
S0690	Green Lambert	Malware	[Green Lambert](https://attack.mitre.org/software/S0690) can use shell scripts for execution, such as <code>/bin/sh -c</code>.(Citation: Objective See...
S1163	SnappyTCP	Malware	[SnappyTCP](https://attack.mitre.org/software/S1163) creates the reverse shell using a pthread spawning a bash shell.(Citation: PWC Sea Turtle 2023)
S0220	Chaos	Malware	[Chaos](https://attack.mitre.org/software/S0220) provides a reverse shell connection on 8338/TCP, encrypted via AES.(Citation: Chaos Stolen Backdoor)

Related CWE Weaknesses

References

• Apple. (2020, January 28). Use zsh as the default shell on your Mac. Retrieved June 12, 2020.
• die.net. (n.d.). bash(1) - Linux man page. Retrieved June 12, 2020.

Frequently Asked Questions

What is T1059.004 (Unix Shell)?

T1059.004 is a MITRE ATT&CK technique named 'Unix Shell'. It belongs to the Execution tactic(s). Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g....

How can T1059.004 be detected?

Detection of T1059.004 (Unix Shell) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.

What mitigations exist for T1059.004?

There are 1 documented mitigations for T1059.004. Key mitigations include: Execution Prevention.

Which threat groups use T1059.004?

Known threat groups using T1059.004 include: Volt Typhoon, APT41, TeamTNT, Rocke, Scattered Spider, UNC3886, Contagious Interview, Sea Turtle.