Uncommon macOS shell command execution
Synopsis
Activation Period
14 Days
Training Period
30 Days
Test Period
N/A (single event)
Deduplication Period
1 Day
Required Data
XDR Agent
Detector Tags
Shell Analytics
ATT&CK Tactic
Execution (TA0002)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059)
Severity
Informational
Description
An unusual process execution of a shell command on macOS. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Variations
Uncommon macOS shell command execution by a BAS solution
Synopsis
ATT&CK Tactic
Execution (TA0002)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059)
Severity
High
Description
An unusual process execution of a shell command on macOS. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Uncommon macOS shell command execution running a curl / wget in an uncommon way
Synopsis
ATT&CK Tactic
Execution (TA0002)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059)
Severity
High
Description
An unusual process execution of a shell command on macOS. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Uncommon macOS shell command execution taking a screenshot
Synopsis
ATT&CK Tactic
Execution (TA0002), Collection (TA0009)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059), Screen Capture (T1113)
Severity
Low
Description
An unusual process execution of a shell command on macOS. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Uncommon macOS shell command execution trying to gather information about the system
Synopsis
ATT&CK Tactic
Execution (TA0002), Discovery (TA0007)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059), System Information Discovery (T1082), Software Discovery (T1518), Account Discovery (T1087), Account Discovery: Local Account (T1087.001), System Owner/User Discovery (T1033), Network Service Discovery (T1046), System Network Configuration Discovery (T1016), System Network Connections Discovery (T1049), File and Directory Discovery (T1083), Peripheral Device Discovery (T1120), Software Discovery: Security Software Discovery (T1518.001)
Severity
Low
Description
An unusual process execution of a shell command on macOS. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Uncommon macOS shell command execution loading a kernel extension
Synopsis
ATT&CK Tactic
Execution (TA0002), Persistence (TA0003), Privilege Escalation (TA0004)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059), Boot or Logon Autostart Execution: Kernel Modules and Extensions (T1547.006)
Severity
Low
Description
An unusual process execution of a shell command on macOS. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Uncommon macOS shell command execution, possibly granting file execution permissions
Synopsis
ATT&CK Tactic
Execution (TA0002), Defense Impairment (TA0112)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059), File and Directory Permissions Modification (T1222)
Severity
Low
Description
An unusual process execution of a shell command on macOS. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Uncommon macOS shell command execution running a process kill command
Synopsis
ATT&CK Tactic
Execution (TA0002)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059)
Severity
Low
Description
An unusual process execution of a shell command on macOS. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Uncommon macOS shell command execution executed an AppleScript
Synopsis
ATT&CK Tactic
Execution (TA0002)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059), Command and Scripting Interpreter: AppleScript (T1059.002)
Severity
Low
Description
An unusual process execution of a shell command on macOS. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Uncommon macOS shell command execution from an unsigned process
Synopsis
ATT&CK Tactic
Execution (TA0002), Stealth (TA0005)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059), Masquerading: Invalid Code Signature (T1036.001)
Severity
Low
Description
An unusual process execution of a shell command on macOS. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Uncommon macOS shell command execution of an exceedingly rare process
Synopsis
ATT&CK Tactic
Execution (TA0002), Discovery (TA0007)
ATT&CK Technique
Command and Scripting Interpreter: Unix Shell (T1059.004), Command and Scripting Interpreter (T1059), Network Service Discovery (T1046)
Severity
Low
Description
An unusual process execution of a shell command on macOS. This action may indicate possible exploitation or shell command execution via a backdoor.
Attacker's Goals
An attacker may attempt to execute a malicious shell command on the system.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Check the executed shell command (and possible child processes) for malicious actions.
Was this helpful?