Skip to content

T1059.004 Unix Shell

Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution.21 Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.

Unix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops. Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems.

Adversaries may abuse Unix shells to execute various commands or payloads. Interactive shells may be accessed through command and control channels or during lateral movement such as with SSH. Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence.

Some systems, such as embedded devices, lightweight Linux distributions, and ESXi servers, may leverage stripped-down Unix shells via Busybox, a small executable that contains a variety of tools, including a simple shell.

Item Value
ID T1059.004
Sub-techniques T1059.001, T1059.002, T1059.003, T1059.004, T1059.005, T1059.006, T1059.007, T1059.008, T1059.009, T1059.010, T1059.011, T1059.012, T1059.013
Tactics TA0002
Platforms ESXi, Linux, Network Devices, macOS
Version 1.4
Created 09 March 2020
Last Modified 24 October 2025

Procedure Examples

ID Name Description
S0504 Anchor Anchor can execute payloads via shell scripting.22
S0584 AppleJeus AppleJeus has used shell scripts to execute commands after installation and set persistence mechanisms.2425
G0096 APT41 APT41 used Linux shell commands for system survey and information gathering prior to exploitation of vulnerabilities such as CVE-2019-19871.65
G0143 Aquatic Panda Aquatic Panda used malicious shell scripts in Linux environments following access via SSH to install Linux versions of Winnti malware.57
S1184 BOLDMOVE BOLDMOVE is capable of spawning a remote command shell.4
S1161 BPFDoor BPFDoor can create a reverse shell and supports vt100 emulator formatting.42
S0482 Bundlore Bundlore has leveraged /bin/sh and /bin/bash to execute commands on the victim machine.10
S0077 CallMe CallMe has the capability to create a reverse shell on victims.48
S1224 CASTLETAP CASTLETAP has the ability to spawn BusyBox command shell in victim environments.5
S0220 Chaos Chaos provides a reverse shell connection on 8338/TCP, encrypted via AES.17
S1105 COATHANGER COATHANGER provides a BusyBox reverse shell for command and control.18
S0369 CoinTicker CoinTicker executes a bash script to establish a reverse shell.35
G1052 Contagious Interview Contagious Interview has targeted macOS victim hosts using a bash downloader coremedia.sh and a bash script cloud.sh.60
S0492 CookieMiner CookieMiner has used a Unix shell script to run a series of commands targeting macOS.51
S1153 Cuckoo Stealer Cuckoo Stealer can spawn a bash shell to enable execution on compromised hosts.37
S0021 Derusbi Derusbi is capable of creating a remote Bash shell and executing commands.1415
S0600 Doki Doki has executed shell scripts with /bin/sh.34
S0502 Drovorub Drovorub can execute arbitrary commands as root on a compromised system.19
S0377 Ebury Ebury can use the commands Xcsh or Xcls to open a shell with Ebury level permissions and Xxsh to open a shell with root level.6
S0401 Exaramel for Linux Exaramel for Linux has a command to execute a shell command on the system.4950
C0053 FLORAHOX Activity FLORAHOX Activity has executed multiple Bash controller scripts to provide command line inputs for FLORAHOX traversal configurations.69
S0410 Fysbis Fysbis has the ability to create and execute commands in a remote shell for CLI.56
S1198 Gomir Gomir reads command line arguments and parses them for functionality when executed from a Linux shell, and can execute arbitrary strings passed to it as shell commands.36
S0690 Green Lambert Green Lambert can use shell scripts for execution, such as /bin/sh -c.4344
S0601 Hildegard Hildegard has used shell scripts for execution.55
S1203 J-magic The J-magic agent is executed through a command line argument which specifies an interface and listening port.53
S0265 Kazuar Kazuar uses /bin/bash to execute commands on the victim’s machine.33
S0599 Kinsing Kinsing has used Unix shell scripts to execute commands in the victim environment.12
S0641 Kobalos Kobalos can spawn a new pseudo-terminal and execute arbitrary commands at the command prompt.13
C0035 KV Botnet Activity KV Botnet Activity utilizes multiple Bash scripts during botnet installation stages, and the final botnet payload allows for running commands in the Bash shell.72
S0451 LoudMiner LoudMiner used shell scripts to launch various services and to start/stop the QEMU virtualization.23
S1016 MacMa MacMa can execute supplied shell commands and uses bash scripts to perform additional actions.4647
S0198 NETWIRE NETWIRE has the ability to use /bin/bash and /bin/sh to execute commands.3132
S1107 NKAbuse NKAbuse is initially installed and executed through an initial shell script.7
C0048 Operation MidnightEclipse During Operation MidnightEclipse, threat actors piped output from stdout to bash for execution.6867
S0402 OSX/Shlayer OSX/Shlayer can use bash scripts to check the macOS version, download payloads, and extract bytes from files. OSX/Shlayer uses the command sh -c tail -c +1381… to extract bytes at an offset from a specified file. OSX/Shlayer uses the curl -fsL “$url” >$tmp_path command to download malicious payloads into a temporary directory.27293028
S0352 OSX_OCEANLOTUS.D OSX_OCEANLOTUS.D uses a shell script as the main executable inside an app bundle and drops an embedded base64-encoded payload to the /tmp folder.2021
S1109 PACEMAKER PACEMAKER can use a simple bash script for execution.16
S0587 Penquin Penquin can execute remote commands using bash scripts.11
S1123 PITSTOP PITSTOP has the ability to receive shell commands over a Unix domain socket.39
S0279 Proton Proton uses macOS’ .command file type to script actions.54
S1108 PULSECHECK PULSECHECK can use Unix shell script for command execution.16
C0055 Quad7 Activity Quad7 Activity has enabled the creation of an access-controlled command shell /bin/sh on compromised routers.7473
C0056 RedPenguin During RedPenguin, UNC3886 used malware capable of launching an interactive shell.7170
S1219 REPTILE REPTILE can deploy components automatically with shell scripts.41
S1222 RIFLESPINE RIFLESPINE can execute commands with /bin/sh.41
G0106 Rocke Rocke used shell scripts to run commands which would obtain persistence and execute the cryptocurrency mining malware.61
G1015 Scattered Spider Scattered Spider has used the command shell to upload and install the Teleport remote access tool to a compromised vCenter Server Appliance.63
G1041 Sea Turtle Sea Turtle used shell scripts for post-exploitation execution in victim environments.866
S0468 Skidmap Skidmap has used pm.sh to download and install its main payload.45
S1163 SnappyTCP SnappyTCP creates the reverse shell using a pthread spawning a bash shell.8
G0139 TeamTNT TeamTNT has used shell scripts for execution.5958
S0647 Turian Turian has the ability to use /bin/sh to execute commands.9
G1048 UNC3886 UNC3886 has used a bash script to install malicious vSphere Installation Bundles (VIBs).40
G1047 Velvet Ant Velvet Ant used a custom tool, VELVETSTING, to parse encoded inbound commands to compromised F5 BIG-IP devices and then execute them via the Unix shell.62
S1217 VIRTUALPITA VIRTUALPITA has the ability to spawn a bash shell for script execution.40
G1017 Volt Typhoon Volt Typhoon has used Brightmetricagent.exe which contains a command- line interface (CLI) library that can leverage command shells including Z Shell (zsh).64
S0466 WindTail WindTail can use the open command to execute an application.26
S0658 XCSSET XCSSET uses a shell script to execute Mach-o files and osacompile commands such as, osacompile -x -o xcode.app main.applescript.52
S1114 ZIPLINE ZIPLINE can use /bin/sh to create a reverse shell and execute commands.38

Mitigations

ID Mitigation Description
M1038 Execution Prevention Use application control where appropriate. On ESXi hosts, the execInstalledOnly feature prevents binaries from being run unless they have been packaged and signed as part of a vSphere installation bundle (VIB).3

References

  1. Apple. (2020, January 28). Use zsh as the default shell on your Mac. Retrieved June 12, 2020. ↩

  2. die.net. (n.d.). bash(1) - Linux man page. Retrieved June 12, 2020. ↩

  3. Alex Marvi, Greg Blaum, and Ron Craft. (2023, June 28). Detection, Containment, and Hardening Opportunities for Privileged Guest Operations, Anomalous Behavior, and VMCI Backdoors on Compromised VMware Hosts. Retrieved March 26, 2025. ↩

  4. Scott Henderson, Cristiana Kittner, Sarah Hawley & Mark Lechtik, Google Cloud. (2023, January 19). Suspected Chinese Threat Actors Exploiting FortiOS Vulnerability (CVE-2022-42475). Retrieved December 31, 2024. ↩

  5. Marvi, A. et al.. (2023, March 16). Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation. Retrieved March 22, 2023. ↩

  6. Marc-Etienne M.Léveillé. (2024, May 1). Ebury is alive but unseen. Retrieved May 21, 2024. ↩

  7. KASPERSKY GERT. (2023, December 14). Unveiling NKAbuse: a new multiplatform threat abusing the NKN protocol. Retrieved February 8, 2024. ↩

  8. PwC Threat Intelligence. (2023, December 5). The Tortoise and The Malware. Retrieved November 20, 2024. ↩↩

  9. Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021 ↩

  10. Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020. ↩

  11. Leonardo. (2020, May 29). MALWARE TECHNICAL INSIGHT TURLA “Penquin_x64”. Retrieved March 11, 2021. ↩

  12. Singer, G. (2020, April 3). Threat Alert: Kinsing Malware Attacks Targeting Container Environments. Retrieved April 1, 2021. ↩

  13. M.Leveille, M., Sanmillan, I. (2021, February 2). Kobalos – A complex Linux threat to high performance computing infrastructure. Retrieved August 24, 2021. ↩

  14. Fidelis Cybersecurity. (2016, February 29). The Turbo Campaign, Featuring Derusbi for 64-bit Linux. Retrieved March 2, 2016. ↩

  15. FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018. ↩

  16. Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024. ↩↩

  17. Sebastian Feldmann. (2018, February 14). Chaos: a Stolen Backdoor Rising Again. Retrieved March 5, 2018. ↩

  18. Dutch Military Intelligence and Security Service (MIVD) & Dutch General Intelligence and Security Service (AIVD). (2024, February 6). Ministry of Defense of the Netherlands uncovers COATHANGER, a stealthy Chinese FortiGate RAT. Retrieved February 7, 2024. ↩

  19. NSA/FBI. (2020, August). Russian GRU 85th GTsSS Deploys Previously Undisclosed Drovorub Malware. Retrieved August 25, 2020. ↩

  20. Magisa, L. (2020, November 27). New MacOS Backdoor Connected to OceanLotus Surfaces. Retrieved December 2, 2020. ↩

  21. Phil Stokes. (2020, December 2). APT32 Multi-stage macOS Trojan Innovates on Crimeware Scripting Technique. Retrieved September 13, 2021. ↩

  22. Grange, W. (2020, July 13). Anchor_dns malware goes cross platform. Retrieved September 10, 2020. ↩

  23. Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020. ↩

  24. Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021. ↩

  25. Patrick Wardle. (2019, October 12). Pass the AppleJeus. Retrieved September 28, 2022. ↩

  26. Wardle, Patrick. (2018, December 20). Middle East Cyber-Espionage analyzing WindShift’s implant: OSX.WindTail (part 1). Retrieved October 3, 2019. ↩

  27. Carbon Black Threat Analysis Unit. (2019, February 12). New macOS Malware Variant of Shlayer (OSX) Discovered. Retrieved August 8, 2019. ↩

  28. Patrick Wardle. (2020, August 30). Apple Approved Malware malicious code …now notarized!? #2020. Retrieved September 13, 2021. ↩

  29. Phil Stokes. (2020, September 8). Coming Out of Your Shell: From Shlayer to ZShlayer. Retrieved September 13, 2021. ↩

  30. Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021. ↩

  31. Lambert, T. (2020, January 29). Intro to Netwire. Retrieved January 7, 2021. ↩

  32. Proofpoint. (2020, December 2). Geofenced NetWire Campaigns. Retrieved January 7, 2021. ↩

  33. Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018. ↩

  34. Fishbein, N., Kajiloti, M.. (2020, July 28). Watch Your Containers: Doki Infecting Docker Servers in the Cloud. Retrieved March 30, 2021. ↩

  35. Thomas Reed. (2018, October 29). Mac cryptocurrency ticker app installs backdoors. Retrieved April 23, 2019. ↩

  36. Symantec Threat Hunter Team. (2024, May 16). Springtail: New Linux Backdoor Added to Toolkit. Retrieved January 17, 2025. ↩

  37. Kohler, A. and Lopez, C. (2024, April 30). Malware: Cuckoo Behaves Like Cross Between Infostealer and Spyware. Retrieved August 20, 2024. ↩

  38. McLellan, T. et al. (2024, January 12). Cutting Edge: Suspected APT Targets Ivanti Connect Secure VPN in New Zero-Day Exploitation. Retrieved February 27, 2024. ↩

  39. Lin, M. et al. (2024, February 27). Cutting Edge, Part 3: Investigating Ivanti Connect Secure VPN Exploitation and Persistence Attempts. Retrieved March 1, 2024. ↩

  40. Alexander Marvi, Jeremy Koppen, Tufail Ahmed, and Jonathan Lepore. (2022, September 29). Bad VIB(E)s Part One: Investigating Novel Malware Persistence Within ESXi Hypervisors. Retrieved March 26, 2025. ↩↩

  41. Punsaen Boonyakarn, Shawn Chew, Logeswaran Nadarajan, Mathew Potaczek, Jakub Jozwiak, and Alex Marvi. (2024, June 18). Cloaked and Covert: Uncovering UNC3886 Espionage Operations. Retrieved September 24, 2024. ↩↩

  42. The Sandfly Security Team. (2022, May 11). BPFDoor - An Evasive Linux Backdoor Technical Analysis. Retrieved September 29, 2023. ↩

  43. Sandvik, Runa. (2021, October 1). Made In America: Green Lambert for OS X. Retrieved March 21, 2022. ↩

  44. Sandvik, Runa. (2021, October 18). Green Lambert and ATT&CK. Retrieved November 17, 2024. ↩

  45. Remillano, A., Urbanec, J. (2019, September 19). Skidmap Linux Malware Uses Rootkit Capabilities to Hide Cryptocurrency-Mining Payload. Retrieved June 4, 2020. ↩

  46. M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022. ↩

  47. Wardle, P. (2021, November 11). OSX.CDDS (OSX.MacMa). Retrieved June 30, 2022. ↩

  48. Falcone, R. and Miller-Osborn, J.. (2016, January 24). Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists. Retrieved February 10, 2016. ↩

  49. Cherepanov, A., Lipovsky, R. (2018, October 11). New TeleBots backdoor: First evidence linking Industroyer to NotPetya. Retrieved November 27, 2018. ↩

  50. ANSSI. (2021, January 27). SANDWORM INTRUSION SET CAMPAIGN TARGETING CENTREON SYSTEMS. Retrieved March 30, 2021. ↩

  51. Chen, y., et al. (2019, January 31). Mac Malware Steals Cryptocurrency Exchanges’ Cookies. Retrieved July 22, 2020. ↩

  52. Mac Threat Response, Mobile Research Team. (2020, August 13). The XCSSET Malware: Inserts Malicious Code Into Xcode Projects, Performs UXSS Backdoor Planting in Safari, and Leverages Two Zero-day Exploits. Retrieved October 5, 2021. ↩

  53. Black Lotus Labs. (2025, January 23). The J-Magic Show: Magic Packets and Where to find them. Retrieved February 17, 2025. ↩

  54. Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018. ↩

  55. Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021. ↩

  56. Bryan Lee and Rob Downs. (2016, February 12). A Look Into Fysbis: Sofacy’s Linux Backdoor. Retrieved September 10, 2017. ↩

  57. CrowdStrike. (2023). 2022 Falcon OverWatch Threat Hunting Report. Retrieved May 20, 2024. ↩

  58. Darin Smith. (2022, April 21). TeamTNT targeting AWS, Alibaba. Retrieved August 4, 2022. ↩

  59. Fiser, D. Oliveira, A. (n.d.). Tracking the Activities of TeamTNT A Closer Look at a Cloud-Focused Malicious Actor Group. Retrieved September 22, 2021. ↩

  60. Amaury G., Coline Chavane, Felix Aimé and Sekoia TDR. (2025, March 31). From Contagious to ClickFake Interview: Lazarus leveraging the ClickFix tactic. Retrieved April 1, 2025. ↩

  61. Liebenberg, D.. (2018, August 30). Rocke: The Champion of Monero Miners. Retrieved May 26, 2020. ↩

  62. Sygnia Team. (2024, June 3). China-Nexus Threat Group ‘Velvet Ant’ Abuses F5 Load Balancers for Persistence. Retrieved March 14, 2025. ↩

  63. Mandiant Incident Response. (2025, July 23). From Help Desk to Hypervisor: Defending Your VMware vSphere Estate from UNC3944. Retrieved October 13, 2025. ↩

  64. CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024. ↩

  65. Glyer, C, et al. (2020, March). This Is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits. Retrieved April 28, 2020. ↩

  66. Hunt & Hackett Research Team. (2024, January 5). Turkish espionage campaigns in the Netherlands. Retrieved November 20, 2024. ↩

  67. Unit 42. (2024, April 12). Threat Brief: Operation MidnightEclipse, Post-Exploitation Activity Related to CVE-2024-3400 . Retrieved January 15, 2025. ↩

  68. Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024. ↩

  69. Raggi, Michael. (2024, May 22). IOC Extinction? China-Nexus Cyber Espionage Actors Use ORB Networks to Raise Cost on Defenders. Retrieved July 8, 2024. ↩

  70. Juniper Networks, Cybersecurity R&D. (2025, March 11). The RedPenguin Malware Incident. Retrieved June 24, 2025. ↩

  71. Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025. ↩

  72. Black Lotus Labs. (2023, December 13). Routers Roasting On An Open Firewall: The KV-Botnet Investigation. Retrieved June 10, 2024. ↩

  73. Batista, João. Gi7w0rm. (2024, August 27). Retrieved June 5, 2025. ↩

  74. Microsoft Threat Intelligence. (2024, October 31). Chinese threat actor Storm-0940 uses credentials from password spray attacks from a covert network. Retrieved June 4, 2025. ↩