Uncommon Linux remote shell command execution
Synopsis
Activation Period
14 Days
Training Period
30 Days
Test Period
N/A (single event)
Deduplication Period
1 Day
Required Data
XDR Agent
Detector Tags
Shell Analytics
ATT&CK Tactic
Execution (TA0002), Lateral Movement (TA0008)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059), Remote Services (T1021)
Severity
Informational
Description
An unusual process execution of a shell command on Linux from a remote source. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Variations
Uncommon Linux remote shell command execution, possibly running LinPEAS
Synopsis
ATT&CK Tactic
Execution (TA0002), Lateral Movement (TA0008), Privilege Escalation (TA0004)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059), Remote Services (T1021), Exploitation for Privilege Escalation (T1068)
Severity
High
Description
An unusual process execution of a shell command on Linux from a remote source. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Uncommon Linux remote shell command execution using an exploitation tool
Synopsis
ATT&CK Tactic
Execution (TA0002), Lateral Movement (TA0008)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059), Remote Services (T1021), Exploitation of Remote Services (T1210)
Severity
High
Description
An unusual process execution of a shell command on Linux from a remote source. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Uncommon Linux remote shell command execution executing a reverse interactive shell
Synopsis
ATT&CK Tactic
Execution (TA0002), Lateral Movement (TA0008)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059), Remote Services (T1021)
Severity
Medium
Description
An unusual process execution of a shell command on Linux from a remote source. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Uncommon Linux remote shell command execution downloading a shell script
Synopsis
ATT&CK Tactic
Execution (TA0002), Lateral Movement (TA0008)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059), Remote Services (T1021)
Severity
Medium
Description
An unusual process execution of a shell command on Linux from a remote source. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Uncommon Linux remote shell command execution disabling firewall
Synopsis
ATT&CK Tactic
Execution (TA0002), Lateral Movement (TA0008), Defense Evasion (TA0005)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059), Remote Services (T1021), Impair Defenses (T1562)
Severity
Low
Description
An unusual process execution of a shell command on Linux from a remote source. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Uncommon Linux remote shell command execution taking a screenshot
Synopsis
ATT&CK Tactic
Execution (TA0002), Lateral Movement (TA0008), Collection (TA0009)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059), Remote Services (T1021), Screen Capture (T1113)
Severity
Low
Description
An unusual process execution of a shell command on Linux from a remote source. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Uncommon Linux remote shell command execution possibly running from an XZ backdoor
Synopsis
ATT&CK Tactic
Execution (TA0002), Lateral Movement (TA0008)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059), Remote Services (T1021)
Severity
Low
Description
An unusual process execution of a shell command on Linux from a remote source. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Uncommon Linux remote shell command execution running as root
Synopsis
ATT&CK Tactic
Execution (TA0002), Lateral Movement (TA0008)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059), Remote Services (T1021)
Severity
Low
Description
An unusual process execution of a shell command on Linux from a remote source. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Uncommon Linux remote shell command execution setting a scheduled task
Synopsis
ATT&CK Tactic
Execution (TA0002), Lateral Movement (TA0008)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059), Remote Services (T1021), Scheduled Task/Job (T1053)
Severity
Low
Description
An unusual process execution of a shell command on Linux from a remote source. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Uncommon Linux remote shell command execution running a process kill command
Synopsis
ATT&CK Tactic
Execution (TA0002), Lateral Movement (TA0008)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059), Remote Services (T1021)
Severity
Low
Description
An unusual process execution of a shell command on Linux from a remote source. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Uncommon Linux remote shell command execution loading a kernel module
Synopsis
ATT&CK Tactic
Execution (TA0002), Lateral Movement (TA0008), Persistence (TA0003), Privilege Escalation (TA0004)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059), Remote Services (T1021), Boot or Logon Autostart Execution: Kernel Modules and Extensions (T1547.006)
Severity
Informational
Description
An unusual process execution of a shell command on Linux from a remote source. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Uncommon Linux remote shell command execution via non-SSH or SSH on a non-standard port
Synopsis
ATT&CK Tactic
Execution (TA0002), Lateral Movement (TA0008), Command and Control (TA0011)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059), Remote Services (T1021), Non-Standard Port (T1571)
Severity
Informational
Description
An unusual process execution of a shell command on Linux from a remote source. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Uncommon Linux remote shell command execution running a network tool
Synopsis
ATT&CK Tactic
Execution (TA0002), Lateral Movement (TA0008), Discovery (TA0007)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059), Remote Services (T1021), Network Service Discovery (T1046)
Severity
Informational
Description
An unusual process execution of a shell command on Linux from a remote source. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Uncommon Linux remote shell command execution trying to gather information about the system
Synopsis
ATT&CK Tactic
Execution (TA0002), Lateral Movement (TA0008), Discovery (TA0007)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059), Remote Services (T1021), System Information Discovery (T1082), Software Discovery (T1518), Account Discovery (T1087), Account Discovery: Local Account (T1087.001), System Owner/User Discovery (T1033), Network Service Discovery (T1046), System Network Configuration Discovery (T1016), System Network Connections Discovery (T1049), File and Directory Discovery (T1083), Peripheral Device Discovery (T1120), Software Discovery: Security Software Discovery (T1518.001)
Severity
Informational
Description
An unusual process execution of a shell command on Linux from a remote source. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Uncommon Linux remote shell command execution, possibly granting file execution permissions
Synopsis
ATT&CK Tactic
Execution (TA0002), Lateral Movement (TA0008), Defense Evasion (TA0005)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059), Remote Services (T1021), File and Directory Permissions Modification (T1222)
Severity
Informational
Description
An unusual process execution of a shell command on Linux from a remote source. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Was this helpful?