T1059.008 — Network Device CLI

Tactic: Execution · Platforms: Network Devices

Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads. The CLI is the primary means through which users and administrators interact with the device in order to view system information, modify device operations, or…

Sub-technique of Command and Scripting Interpreter (T1059).

Sigma detection rules (1)

T1059.008 Command and Scripting Interpreter: Network Device CLI

title: "T1059.008 Command and Scripting Interpreter: Network Device CLI"
id: fc5e72a1-4292-4bf1-9d9c-418a755dd05a
description: 'Behavioral Detection of CLI Abuse on Network Devices. (Data Component: Command Execution; baseline tier: fallback.) Tune using: TimeWindow, UserContext, CommandPattern, SourceIP, SessionDuration.'
references:
  - https://attack.mitre.org/techniques/T1059/008
author: Shahrukh Khan
date: 2026-06-16
license: MIT
tags:
  - attack.execution
  - attack.t1059.008

logsource:
  category: process_creation
  product: networkdevice
  service: syslog

detection:
  selection_shell:
    Message|contains:
      - 'network-cli'
      - 'switch shell'
      - 'vsh'
      - 'linux shell access'
  selection_exec:
    Message|contains:
      - 'execute-shell'
      - 'guestshell'
  condition: 1 of selection_*

falsepositives:
  - Authorized use of a vendor guest shell or Linux subsystem by network engineers for approved scripting tasks.

level: medium

Related sub-techniques

Explore