T1059.004

Description from ATT&CK

Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution.(Citation: DieNet Bash)(Citation: Apple ZShell) Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.

Unix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops. Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems.

Adversaries may abuse Unix shells to execute various commands or payloads. Interactive shells may be accessed through command and control channels or during lateral movement such as with SSH. Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence.

Some systems, such as embedded devices, lightweight Linux distributions, and ESXi servers, may leverage stripped-down Unix shells via Busybox, a small executable that contains a variety of tools, including a simple shell.

Tests

Test #1 - Execute shell script

Adversaries use the Unix shell to execute commands and scripts.

Input Arguments:

do shell script "sw_vers -productVersion"

Download Files

Test #2 - Execute shell script using administrator privileges

Adversaries use the Unix shell to execute commands and scripts.

Input Arguments:

do shell script "whoami" with administrator privileges

Download Files

Test #3 - Execute shell commands in Terminal

Adversaries use the Unix shell to execute commands and scripts.

Input Arguments:

tell application "Terminal"
  do script "sw_vers -productVersion"
  delay 3
  try
    quit
  end try
end tell

Download Files

References

• MITRE ATT&CK T1059.004
• Apple Script Language Guide