Unix Shell
Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution.(Citation: DieNet Bash)(Citation: Apple ZShell) Unix shells can control every aspect of a system, with certain commands requiring elevated privileges. Unix shells also support scripts that enable sequential execution of commands...
BY SOURCE
PROCEDURES (82)
Auto-extracted: 12 detections for general monitoring
Auto-extracted: 9 detections for persist
Auto-extracted: 7 detections for process creation monitoring
Auto-extracted: 4 detections for suspicious
Auto-extracted: 4 detections for token
Auto-extracted: 3 detections for http
Auto-extracted: 3 detections for child process
Auto-extracted: 3 detections for container
Auto-extracted: 3 detections for aws
Auto-extracted: 3 detections for download
Auto-extracted: 3 detections for exfiltrat
Auto-extracted: 3 detections for network connection monitoring
Auto-extracted: 2 detections for bypass
Auto-extracted: 2 detections for obfuscat
Auto-extracted: 2 detections for command and control
Auto-extracted: 2 detections for inject
Auto-extracted: 2 detections for remote
Auto-extracted: 2 detections for inject
Auto-extracted: 2 detections for parent process
Auto-extracted: 2 detections for privilege
Auto-extracted: 2 detections for suspicious
Auto-extracted: 2 detections for remote
Auto-extracted: 2 detections for kernel
Auto-extracted: 2 detections for credential
Auto-extracted: 2 detections for startup
Auto-extracted: 2 detections for inject
Auto-extracted: 2 detections for exfiltrat
Auto-extracted: 2 detections for script execution monitoring
Auto-extracted: 2 detections for persist
Auto-extracted: 2 detections for container
Auto-extracted: 2 detections for parent process
Auto-extracted: 2 detections for parent process
Auto-extracted: 2 detections for kubernetes
Auto-extracted: 2 detections for obfuscat
Auto-extracted: 1 detections for child process
Auto-extracted: 1 detections for cloud monitoring
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for child process
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for command and control
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for registry monitoring
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for command and control
Auto-extracted: 1 detections for download
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for obfuscat
Auto-extracted: 1 detections for obfuscat
Auto-extracted: 1 detections for api
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for kernel monitoring
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for download
Auto-extracted: 1 detections for c2
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for base64
Auto-extracted: 1 detections for c2
Auto-extracted: 1 detections for startup
Auto-extracted: 1 detections for kernel
Auto-extracted: 1 detections for kernel
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for base64
Auto-extracted: 1 detections for token
Auto-extracted: 1 detections for kubernetes
Auto-extracted: 1 detections for container
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for aws
Auto-extracted: 1 detections for c2
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for bypass