Procedure examples

BRICKSTORM has executed shell commands using `/bin/sh`.

COATHANGER provides a BusyBox reverse shell for command and control.

WindTail can use the open command to execute an application.

Exaramel for Linux has a command to execute a shell command on the system.

CASTLETAP has the ability to spawn BusyBox command shell in victim environments.

NETWIRE has the ability to use /bin/bash and /bin/sh to execute commands.

The J-magic agent is executed through a command line argument which specifies an interface and listening port.

Gomir reads command line arguments and parses them for functionality when executed from a Linux shell, and can execute arbitrary strings passed to it as shell commands.

BOLDMOVE is capable of spawning a remote command shell.

Turian has the ability to use /bin/sh to execute commands.

Hildegard has used shell scripts for execution.

Cuckoo Stealer can spawn a bash shell to enable execution on compromised hosts.

Skidmap has used pm.sh to download and install its main payload.

REPTILE can deploy components automatically with shell scripts.

Doki has executed shell scripts with /bin/sh.

Fysbis has the ability to create and execute commands in a remote shell for CLI.

Kazuar uses /bin/bash to execute commands on the victim’s machine.

Green Lambert can use shell scripts for execution, such as /bin/sh -c.

SnappyTCP creates the reverse shell using a pthread spawning a bash shell.

Chaos provides a reverse shell connection on 8338/TCP, encrypted via AES.

Anchor can execute payloads via shell scripting.

PACEMAKER can use a simple bash script for execution.

Bundlore has leveraged /bin/sh and /bin/bash to execute commands on the victim machine.

BPFDoor can create a reverse shell and supports vt100 emulator formatting.

Derusbi is capable of creating a remote Bash shell and executing commands.

Drovorub can execute arbitrary commands as root on a compromised system.

PULSECHECK can use Unix shell script for command execution.

Kobalos can spawn a new pseudo-terminal and execute arbitrary commands at the command prompt.

OSX_OCEANLOTUS.D uses a shell script as the main executable inside an app bundle and drops an embedded base64-encoded payload to the /tmp folder.

NKAbuse is initially installed and executed through an initial shell script.

MacMa can execute supplied shell commands and uses bash scripts to perform additional actions.

Proton uses macOS' .command file type to script actions.

CallMe has the capability to create a reverse shell on victims.

RIFLESPINE can execute commands with `/bin/sh`.

CoinTicker executes a bash script to establish a reverse shell.

Penquin can execute remote commands using bash scripts.

Ebury can use the commands `Xcsh` or `Xcls` to open a shell with Ebury level permissions and `Xxsh` to open a shell with root level.

Kinsing has used Unix shell scripts to execute commands in the victim environment.

PITSTOP has the ability to receive shell commands over a Unix domain socket.

ZIPLINE can use `/bin/sh` to create a reverse shell and execute commands.

Shai-Hulud has utilized Linux shell commands to modify configuration files.

VIRTUALPITA has the ability to spawn a bash shell for script execution.

XCSSET uses a shell script to execute Mach-o files and osacompile commands such as, osacompile -x -o xcode.app main.applescript.

AppleJeus has used shell scripts to execute commands after installation and set persistence mechanisms.

CookieMiner has used a Unix shell script to run a series of commands targeting macOS.

OSX/Shlayer can use bash scripts to check the macOS version, download payloads, and extract bytes from files. OSX/Shlayer uses the command sh -c tail -c +1381... to extract bytes at an offset from a specified file. OSX/Shlayer uses the curl -fsL "$url" >$tmp_path command to download malicious payloads into a temporary directory.

LoudMiner used shell scripts to launch various services and to start/stop the QEMU virtualization.

TeamPCP Cloud Stealer has abused the shell script files entrypoint.sh (in trivy-action) and setup.sh (in ast-github-action/2.3.28) for discovery and credential harvesting.

CanisterWorm has used shell commands to enable and start the malicious systemd service for execution and persistence.