T1059.004sub-technique of T1059 Command and Scripting Interpreter
Unix Shell
ESXi · Linux · macOS · Network Devices5 pieces on this siteT1059.004 on attack.mitre.org
Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution. Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Suspicious execution on an endpoint
An EDR alert, an unexplained process, or a user reporting something odd.
The evidence it leaves
Where the traces live, and what each source proves and does not.
Shell history
Apple Unified Log
auditd
Read
Analyses, case studies, guides, references and interview questions.
Zimbra, again: unauthenticated command injection over SMTP
CVE-2026-73570 needs no credentials and no user interaction. A crafted SMTP request executes commands as the zimbra user. Mail servers accept connections from strangers by definition, which is what makes pre-auth bugs in them a different category of problem.
Gitea's diffpatch endpoint plants a Git hook, and the hook does the rest
CVE-2026-60004 turns repository write access into shell execution as the Gitea service account. The interesting part is not the injection. It is that Git hooks are executable files sitting inside a directory your developers write to all day.
how MITRE says to see it
Behavioral Detection of Unix Shell Execution
- Detects bash, sh, zsh, or BusyBox shell execution initiated via remote sessions, unauthorized users, or embedded within secondary script interpreters. Focus is on chained behavior: shell > suspicious commands > network discovery or persistence indicators.
- Identifies use of sh/bash/zsh in suspicious context, such as user scripts launched from non-standard apps (e.g., Preview.app), embedded in LaunchDaemons, or executed outside Terminal.app. Looks for misuse in Automator, LaunchAgents, or NSAppleScript-executed shell.
- Detects BusyBox or Ash shell execution from unauthorized logins or remote connections. Focus is on rare shell invocations from DCUI, SSH sessions, or remote management paths. Also watches for payload droppers or persistence artifacts using shell.
- Detects Unix shell usage on network appliances (e.g., routers, firewalls, embedded Linux) through rare console commands, CLI interfaces, or script injection via exposed APIs or SSH.
what reduces it
- M1038 Execution Prevention. Use application control where appropriate. On ESXi hosts, the `execInstalledOnly` feature prevents binaries from being run unless they have been packaged and signed as part of a vSphere installation bundle (VIB).