| ID | Name |
|---|---|
| T1623.001 | Unix Shell |
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, Android is a UNIX-like OS and includes a basic Unix Shell that can be accessed via the Android Debug Bridge (ADB) or Java’s Runtime package.
Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells.
| ID | Name | Description |
|---|---|---|
| S1185 | LightSpy |
LightSpy has plugins for executing shell commands either from the C2 server or a library file called |
| S9040 | NGate |
NGate has used Java to execute a variety of actions, such as loading and verifying runtime configuration and disabling the launcher if decryption or parsing failed.[4] |
| S1056 | TianySpy |
| ID | Mitigation | Description |
|---|---|---|
| M1002 | Attestation |
Device attestation can often detect jailbroken or rooted devices. |
| M1010 | Deploy Compromised Device Detection Method |
Mobile security products can typically detect jailbroken or rooted devices. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0655 | Detection of Command and Scripting Interpreter | AN1741 |
For Android, detect Command and Scripting Interpreter from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Command Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: App spawns sh, bash, toybox, toolbox, or su child process with command arguments within $ShellActivityWindow$ of shell launch — child shell process with arguments is the script execution signal]; Process Creation via Application Vetting / Managed Device Telemetry [App invokes Runtime.exec(), ProcessBuilder.start(), or JNI-backed command execution framework to spawn shell or command interpreter process NOT IN $ApprovedShellApps$ — programmatic shell spawn is the interpreter invocation]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone. |
| AN1742 |
For iOS, detect Command and Scripting Interpreter from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Command Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: Shell process (sh, bash) or command-executing child process spawned under app context on supervised iOS device — any shell spawn on stock iOS indicates jailbreak or kernel exploit]; Process Creation via Application Vetting / Managed Device Telemetry [Managed iOS app invokes lower-level process-launch behavior or command-execution-equivalent activity outside sandbox-permitted APIs on supervised device]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone. |