Uncommon Linux shell command execution
Synopsis
Activation Period
14 Days
Training Period
30 Days
Test Period
N/A (single event)
Deduplication Period
1 Day
Required Data
XDR Agent
Detector Tags
Shell Analytics
ATT&CK Tactic
Execution (TA0002)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059)
Severity
Informational
Description
An unusual process execution of a shell command on Linux. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Variations
Uncommon Linux shell command execution by a BAS solution
Synopsis
ATT&CK Tactic
Execution (TA0002)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059)
Severity
High
Description
An unusual process execution of a shell command on Linux. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Uncommon Linux shell command execution disabling firewall
Synopsis
ATT&CK Tactic
Execution (TA0002), Defense Impairment (TA0112)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059), Disable or Modify Tools (T1685)
Severity
High
Description
An unusual process execution of a shell command on Linux. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Uncommon Linux shell command execution, possibly running LinPEAS
Synopsis
ATT&CK Tactic
Execution (TA0002), Privilege Escalation (TA0004)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059), Exploitation for Privilege Escalation (T1068)
Severity
High
Description
An unusual process execution of a shell command on Linux. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Uncommon Linux shell command execution using exploitation tool
Synopsis
ATT&CK Tactic
Execution (TA0002)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059)
Severity
High
Description
An unusual process execution of a shell command on Linux. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Uncommon Linux shell command execution taking a screenshot
Synopsis
ATT&CK Tactic
Execution (TA0002), Collection (TA0009)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059), Screen Capture (T1113)
Severity
Low
Description
An unusual process execution of a shell command on Linux. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Uncommon Linux shell command execution trying to gather information about the system
Synopsis
ATT&CK Tactic
Execution (TA0002), Discovery (TA0007)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059), System Information Discovery (T1082), Software Discovery (T1518), Account Discovery (T1087), Account Discovery: Local Account (T1087.001), System Owner/User Discovery (T1033), Network Service Discovery (T1046), System Network Configuration Discovery (T1016), System Network Connections Discovery (T1049), File and Directory Discovery (T1083), Peripheral Device Discovery (T1120), Software Discovery: Security Software Discovery (T1518.001)
Severity
Low
Description
An unusual process execution of a shell command on Linux. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Uncommon Linux shell command execution loading a kernel module
Synopsis
ATT&CK Tactic
Execution (TA0002), Persistence (TA0003), Privilege Escalation (TA0004)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059), Boot or Logon Autostart Execution: Kernel Modules and Extensions (T1547.006)
Severity
Low
Description
An unusual process execution of a shell command on Linux. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Uncommon Linux shell command execution, possibly granting file execution permissions
Synopsis
ATT&CK Tactic
Execution (TA0002), Defense Impairment (TA0112)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059), File and Directory Permissions Modification (T1222)
Severity
Low
Description
An unusual process execution of a shell command on Linux. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Uncommon Linux shell command execution running a network tool
Synopsis
ATT&CK Tactic
Execution (TA0002), Discovery (TA0007)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059), Network Service Discovery (T1046)
Severity
Low
Description
An unusual process execution of a shell command on Linux. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Uncommon Linux shell command execution setting a scheduled task
Synopsis
ATT&CK Tactic
Execution (TA0002)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059), Scheduled Task/Job (T1053)
Severity
Low
Description
An unusual process execution of a shell command on Linux. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Uncommon Linux shell command execution running a process kill command
Synopsis
ATT&CK Tactic
Execution (TA0002)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059)
Severity
Low
Description
An unusual process execution of a shell command on Linux. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Uncommon Linux shell command execution with su/sudo elevation
Synopsis
ATT&CK Tactic
Execution (TA0002)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059)
Severity
Informational
Description
An unusual process execution of a shell command on Linux. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Uncommon Linux shell command execution accessing history (e.g. bash history or login records)
Synopsis
ATT&CK Tactic
Execution (TA0002), Credential Access (TA0006)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059), Unsecured Credentials: Shell History (T1552.003)
Severity
Informational
Description
An unusual process execution of a shell command on Linux. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Uncommon Linux shell command execution from a scripting language interpreter
Synopsis
ATT&CK Tactic
Execution (TA0002)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059)
Severity
Informational
Description
An unusual process execution of a shell command on Linux. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Uncommon Linux shell command execution executed from within a web server
Synopsis
ATT&CK Tactic
Execution (TA0002)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059)
Severity
Informational
Description
An unusual process execution of a shell command on Linux. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Was this helpful?