Command and Scripting Interpreter: Unix Shell T1059.004

Events covered

13 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 162 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (74 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

Top indicator values (2124 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

Exclusions (1131 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 18 rules

• AWS EC2 Startup Shell Script Change
• Axios NPM Compromise Indicators - Linux
• Axios NPM Compromise Indicators - macOS
• BPFtrace Unsafe Option Usage
• Equation Group Indicators
• Interactive Bash Suspicious Children
• JexBoss Command Sequence
• Linux Reverse Shell Indicator
• Nohup Execution
• Potential Abuse of Linux Magic System Request Key
• Potentially Suspicious Long Filename Pattern - Linux
• Script Interpreter Spawning Credential Scanner - Linux
• Shell Invocation via Env Command - Linux
• Suspicious Activity in Shell Commands
• Suspicious Commands Linux
• Suspicious Download and Execute Pattern via Curl/Wget
• Suspicious Filename with Embedded Base64 Commands
• Suspicious Reverse Shell Command Line

Elastic 135 rules

• Attempt to Install or Run Kali Linux via WSL
• AWS EC2 LOLBin Execution via SSM SendCommand
• AWS SSM `SendCommand` with Run Shell Command Parameters
• AWS SSM Session Manager Child Process Execution
• Azure Run Command Script Child Process
• Base64 Decoded Payload Piped to Interpreter
• Boot File Copy
• BPF filter applied using TC
• Cupsd or Foomatic-rip Shell Execution
• Curl Execution via Shell Profile
• Curl or Wget Egress Network Connection via LoLBin
• Decoded Payload Piped to Interpreter Detected via Defend for Containers
• Deprecated - Uncommon Destination Port Connection by Web Server
• Deprecated - Unusual Command Execution from Web Server Parent
• Deprecated - Unusual Process Spawned from Web Server Parent
• Direct Interactive Kubernetes API Request by Common Utilities
• Direct Interactive Kubernetes API Request by Unusual Utilities
• Direct Interactive Kubernetes API Request Detected via Defend for Containers
• Dracut Module Creation
• Dynamic Linker (ld.so) Creation
• Egress Connection from Entrypoint in Container
• Encoded Payload Detected via Defend for Containers
• Execution via GitHub Actions Runner
• Execution via OpenClaw Agent
• Execution via Windows Subsystem for Linux
• Execution with Explicit Credentials via Scripting
• File Creation and Execution Detected via Defend for Containers
• File Creation by Cups or Foomatic-rip Child
• File Creation in /var/log via Suspicious Process
• File Creation, Execution and Self-Deletion in Suspicious Directory
• File Download Detected via Defend for Containers
• File Transfer or Listener Established via Netcat
• File Transfer Utility Launched from Unusual Parent
• First Time Python Spawned a Shell on Host
• Forbidden Direct Interactive Kubernetes API Request
• Git Hook Child Process
• Git Hook Command Execution
• Git Hook Created or Modified
• Git Hook Egress Network Connection
• GitHub Authentication Token Access via Node.js
• Host File System Changes via Windows Subsystem for Linux
• Ingress Tool Transfer Followed by Execution and Deletion Detected via Defend for Containers
• Initramfs Unpacking via unmkinitramfs
• Interactive Exec Into Container Detected via Defend for Containers
• Interactive Shell Launched via Unusual Parent Process in a Container
• Interactive Shell Spawn Detected via Defend for Containers
• Interactive Terminal Spawned via Perl
• Interactive Terminal Spawned via Python
• Kill Command Execution
• Kubernetes Direct API Request via Curl or Wget
• Linux Restricted Shell Breakout via Linux Binary(s)
• Manual Dracut Execution
• Memory Swap Modification
• Multi-Base64 Decoding Attempt from Suspicious Location
• Netcat File Transfer or Listener Detected via Defend for Containers
• Netcat Listener Established via rlwrap
• Network Connection by Cups or Foomatic-rip Child
• Network Connection from Binary with RWX Memory Region
• Network Connection via Recently Compiled Executable
• Network Connections Initiated Through XDG Autostart Entry
• NetworkManager Dispatcher Script Creation
• Node.js Pre or Post-Install Script Execution
• Openssl Client or Server Activity
• Payload Execution via Shell Pipe Detected by Defend for Containers
• Pod or Container Creation with Suspicious Command-Line
• Potential Code Execution via Postgresql
• Potential Direct Kubelet Access via Process Arguments
• Potential Direct Kubelet Access via Process Arguments Detected via Defend for Containers
• Potential Etherhiding C2 via Blockchain Connection
• Potential Execution via SSH Backdoor
• Potential Git CVE-2025-48384 Exploitation
• Potential Hex Payload Execution via Command-Line
• Potential Hex Payload Execution via Common Utility
• Potential JAVA/JNDI Exploitation Attempt
• Potential Kubeletctl Execution
• Potential Kubeletctl Execution Detected via Defend for Containers
• Potential Malware-Driven SSH Brute Force Attempt
• Potential Meterpreter Reverse Shell
• Potential Reverse Shell
• Potential Reverse Shell via Background Process
• Potential Reverse Shell via Child
• Potential Reverse Shell via Java
• Potential Reverse Shell via Suspicious Binary
• Potential Reverse Shell via Suspicious Child Process
• Potential Reverse Shell via UDP
• Potential SAP NetWeaver Exploitation
• Potential Shell via Wildcard Injection Detected
• Potential Upgrade of Non-interactive Shell
• Printer User (lp) Shell Execution
• Privileged Container Creation with Host Directory Mount
• Privileged Docker Container Creation
• Process Backgrounded by Unusual Parent
• Process Spawned from Message-of-the-Day (MOTD)
• Process Started with Executable Stack
• Proxy Shell Execution via Busybox
• Python Path File (pth) Creation
• Python Site or User Customize File Creation
• Root Network Connection via GDB CAP_SYS_PTRACE
• Service Account Token or Certificate Access Followed by Kubernetes API Request
• Shell Execution via Apple Scripting
• Simple HTTP Web Server Connection
• Simple HTTP Web Server Creation
• Suspicious APT Package Manager Execution
• Suspicious APT Package Manager Network Connection
• Suspicious Browser Child Process
• Suspicious Content Extracted or Decompressed via Funzip
• Suspicious Echo or Printf Execution Detected via Defend for Containers
• Suspicious Emond Child Process
• Suspicious Execution via Windows Subsystem for Linux
• Suspicious File Creation via Pkg Install Script
• Suspicious Installer Package Spawns Network Event
• Suspicious Interpreter Execution Detected via Defend for Containers
• Suspicious macOS MS Office Child Process
• Suspicious Mining Process Creation Event
• Suspicious Named Pipe Creation
• Suspicious Path Invocation from Command Line
• Suspicious Process Execution Detected via Defend for Containers
• Suspicious React Server Child Process
• Suspicious System Commands Executed by Previously Unknown Executable
• System Path File Creation and Execution Detected via Defend for Containers
• Systemd Shell Execution During Boot
• Unknown Execution of Binary with RWX Memory Region
• Unusual Base64 Encoding/Decoding Activity
• Unusual Child Execution via Web Server
• Unusual Command Execution via Web Server
• Unusual D-Bus Daemon Child Process
• Unusual Execution from Kernel Thread (kthreadd) Parent
• Unusual File Creation by Web Server
• Unusual Interactive Shell Launched from System User
• Unusual LD_PRELOAD/LD_LIBRARY_PATH Command Line Arguments
• Unusual Pkexec Execution
• Web Server Exploitation Detected via Defend for Containers
• Web Server Potential Command Injection Request
• Web Server Potential SQL Injection Request
• Windows Subsystem for Linux Distribution Installed

Splunk 9 rules

• Common Reconnaissance Commands (PowerShell)
• Common Reconnaissance Commands (Sysmon)
• Common Reconnaissance Commands (Windows Event Log)
• Linux Decode Base64 to Shell
• Linux Magic SysRq Key Abuse
• Linux Suspicious React or Next.js Child Process
• Linux Unix Shell Enable All SysRq Functions
• MacOS LOLbin
• Suspicious Linux Discovery Commands