Behavioral Detection of Unix Shell Execution

4 analytic(s) · 1 technique(s) detected

Analytics

AN1081 Analytic 1081

Linux

Detects bash, sh, zsh, or BusyBox shell execution initiated via remote sessions, unauthorized users, or embedded within secondary script interpreters. Focus is on chained behavior: shell > suspicious commands > network discovery or persistence indicators.

auditd:SYSCALL execve linux:osquery socket_events linux:syslog auth.log / secure.log

[ExecutableName] Detect variants like /bin/sh, /usr/local/bin/zsh, /bin/busybox sh.

[UserContext] Shell used by service accounts, root, or rare accounts.

[ParentProcess] Shell invoked by unexpected parents (e.g., curl, mail, apache2).

[TimeWindow] Execution outside maintenance windows or normal activity periods.

[CommandLinePattern] Flags use of loops, download commands, chaining (|, &&), or reverse shells.

AN1082 Analytic 1082

macOS

Identifies use of sh/bash/zsh in suspicious context, such as user scripts launched from non-standard apps (e.g., Preview.app), embedded in LaunchDaemons, or executed outside Terminal.app. Looks for misuse in Automator, LaunchAgents, or NSAppleScript-executed shell.

macos:unifiedlog log stream --predicate 'eventMessage contains "exec"' macos:osquery launchd + process_events macos:syslog system.log, asl.log

[ScriptLocation] Execution from /Users/Shared, ~/Library/LaunchAgents, /tmp.

[ParentProcess] Shells spawned from Preview, Safari, or AppleScript.

[UserRole] Detection thresholds may differ for admin vs standard users.

AN1083 Analytic 1083

ESXi

Detects BusyBox or Ash shell execution from unauthorized logins or remote connections. Focus is on rare shell invocations from DCUI, SSH sessions, or remote management paths. Also watches for payload droppers or persistence artifacts using shell.

esxi:vmkernel DCUI shell start, BusyBox activity esxi:auth Shell login or escalation

[UserContext] Non-root use of shell (or root outside maintenance window).

[CommandPattern] Use of ‘nc’, ‘wget’, or dropper-like behavior in shell.

[ShellPath] Unexpected invocation of BusyBox/ash from mounted ISO or datastore.

AN1084 Analytic 1084

Network Devices

Detects Unix shell usage on network appliances (e.g., routers, firewalls, embedded Linux) through rare console commands, CLI interfaces, or script injection via exposed APIs or SSH.

networkdevice:syslog CLI Command Audit NSM:Flow remote access

[Interface] Flags command line access via remote console (telnet/SSH/API) from non-whitelisted source.

[CommandString] Monitors rare/privileged shell commands (e.g., enable, tftp, firmware mod).

Detected Techniques

Execution (1)

T1059.004 Unix Shell

Details

MITRE ID: DET0384
STIX ID: x-mitre-detection-strategy--4a89bf52-7be1-405d-8d02-462e52553bc5
Analytics: 4
Techniques Detected: 1
By Tactic