Skip to content
Sign In
Learn

T1059.004

Unix Shell

What it is

Attackers run commands through a Unix shell such as bash or sh on Linux and macOS hosts. It is a sub-technique of Command and Scripting Interpreter, under the Execution tactic. On servers it is the main way an attacker works once they have a session, because the shell and its standard tools are already installed and their commands look like ordinary administration.

How adversaries use it

After gaining a session, through a remote login, a vulnerable web application or a stolen account, the attacker types commands or runs shell scripts. They download tools with built-in utilities, chain commands with ; or &&, and pipe one tool into another. Scripts let them repeat the same steps on many servers.

Detect it in Elastic

Data source: Linux process execution events (Auditbeat or Elastic Defend)

Key fields

event.action: executed (Auditbeat) or exec (Elastic Defend) when a program runs process.executable: the program that ran process.args: the program and its arguments process.parent.executable: what started it, often a shell (Elastic Defend; Auditbeat records only the parent's process ID) user.name: the account it ran as host.name, @timestamp

Example event

{
  "host": {
    "name": "srv-031.corp.example"
  },
  "user": {
    "name": "m.castell"
  },
  "event": {
    "action": "exec"
  },
  "process": {
    "args": [
      "sh",
      "/dev/shm/.cache-upd"
    ],
    "parent": {
      "executable": "/usr/sbin/httpd"
    },
    "executable": "/bin/sh"
  },
  "@timestamp": "2026-05-14T11:06:42.215Z"
}

Prebuilt Elastic rule: Unusual Command Execution via Web Server

Hunt guidance

With Elastic Defend data, start with shells started by services that should never start one: process.name: ("bash" or "sh") and process.parent.name: ("httpd" or "java" or "php-fpm"). Then look for programs run from world-writable folders: process.executable: /dev/shm/* or process.executable: /var/tmp/*. Look for scripts run from those folders, encoded text decoded and piped into a shell, and many commands from one account in a short burst. The prebuilt rule named on this page looks for a narrower pattern and wouldn't fire on the example event above, so use it alongside this hunt, not instead of it.

Ruling out legitimate activity

Administrators, deployment tools and scheduled maintenance run shells all day. Compare the account, the parent program, the time and the host's normal jobs. A shell started by a web server or database process is rarely legitimate; one started by a known deployment tool usually is.

Telemetry needed

The log events that help detect this technique, from the Telemetry reference: which log source to collect, which event in it, and how to enable each one.

References

Practice it

No range covers this technique yet; the write-up above landed first. Ranges are added continuously; the ones live today are on the training ladder.