MITRE ATT&CKsub-technique

T1059.004 Unix Shell

Published 2020-03-09 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Execution
Platforms
ESXi, Linux, macOS, Network Devices
Version
1.4
Created
2020-03-09

Description

Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution. Unix shells can control every aspect of a system, with certain commands requiring elevated privileges. Unix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops. Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems. Adversaries may abuse Unix shells to execute various commands or payloads. Interactive shells may be accessed through command and control channels or during lateral movement such as with SSH. Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence. Some systems, such as embedded devices, lightweight Linux distributions, and ESXi servers, may leverage stripped-down Unix shells via Busybox, a small executable that contains a variety of tools, including a simple shell.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1059 Command and Scripting Interpreter technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (1)

  • M1038 Execution Prevention mitigation

Referenced by MITRE ATT&CK · uses (70)

  • S9063 DEEPROOT software (malware)
  • C0064 AI-Assisted Breach of Mexico's Government Infrastructure campaign
  • S9042 CanisterWorm software (malware)
  • G1056 TeamPCP group
  • S9041 TeamPCP Cloud Stealer software (malware)
  • C0063 2025 Poland Wiper Attacks campaign
  • S9015 BRICKSTORM software (malware)
  • S9008 Shai-Hulud software (malware)
  • G1052 Contagious Interview group
  • C0056 RedPenguin campaign
  • S1224 CASTLETAP software (malware)
  • S1222 RIFLESPINE software (malware)
  • S1219 REPTILE software (malware)
  • C0055 Quad7 Activity campaign
  • S1217 VIRTUALPITA software (malware)
  • G1048 UNC3886 group
  • C0053 FLORAHOX Activity campaign
  • G1047 Velvet Ant group
  • G1045 Salt Typhoon group
  • S1203 J-magic software (malware)
  • S1198 Gomir software (malware)
  • C0048 Operation MidnightEclipse campaign
  • S1184 BOLDMOVE software (malware)
  • G1041 Sea Turtle group
  • S1163 SnappyTCP software (malware)
  • S1161 BPFDoor software (malware)
  • S1153 Cuckoo Stealer software (malware)
  • C0035 KV Botnet Activity campaign
  • S1123 PITSTOP software (malware)
  • S1114 ZIPLINE software (malware)
Show all 70 ›

Referenced by Compliance · mitigates (12)

  • CIS-2.7 Allowlist Authorized Scripts CIS Safeguard v8.1
  • NIST-AC-17 Remote Access NIST 800-53 control
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-SI-10 Information Input Validation NIST 800-53 control
  • NIST-SI-16 Memory Protection NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References