Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the underlying command prompts on Android and iOS devices. Unix shells can control every aspect of a system, with certain commands requiring elevated privileges that are only accessible if the device has been rooted or jailbroken.
Unix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops. Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems.
Adversaries may abuse Unix shells to execute various commands or payloads. Interactive shells may be accessed through command and control channels or during lateral movement such as with SSH. Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence.
If the device has been rooted or jailbroken, adversaries may locate and invoke a superuser binary to elevate their privileges and interact with the system as the root user. This dangerous level of permissions allows the adversary to run special commands and modify protected system files.
| ID | Name | Description |
|---|---|---|
| S1061 | AbstractEmu |
AbstractEmu has included encoded shell scripts to potentially aid in the rooting process.[1] |
| S0655 | BusyGasper |
BusyGasper can run shell commands.[2] |
| S0555 | CHEMISTGAMES |
CHEMISTGAMES can run bash commands.[3] |
| S0550 | DoubleAgent |
DoubleAgent can run arbitrary shell commands.[4] |
| S0544 | HenBox | |
| S1082 | Sunbird | |
| S0558 | Tiktok Pro |
Tiktok Pro can execute commands .[7] |
| ID | Mitigation | Description |
|---|---|---|
| M1002 | Attestation |
Device attestation can often detect jailbroken or rooted devices. |
| M1010 | Deploy Compromised Device Detection Method |
Mobile security products can typically detect jailbroken or rooted devices. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0607 | Detection of Unix Shell | AN1657 |
For Android, detect Unix Shell from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Command Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: Unix shell process (sh, bash, busybox sh, toybox) spawns as child of app process with command-line arguments indicating scripted operation — shell with arguments confirms script execution not interactive terminal]; Process Creation via Application Vetting / Managed Device Telemetry [Application invokes Runtime.exec(), ProcessBuilder.start(), or JNI-backed launcher with sh, bash, toybox, toolbox, or su as command argument NOT IN $ApprovedShellApps$ — explicit Unix shell invocation]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone. |
| AN1658 |
For iOS, detect Unix Shell from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Command Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: Shell or command-executing child process with arguments spawned under managed app context on supervised iOS device]; Process Creation via Application Vetting / Managed Device Telemetry [Managed iOS app invokes process-launch behavior resulting in sh, bash, or equivalent shell child process on supervised device — any shell spawn on stock iOS is a jailbreak indicator]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone. |