Detect Unix Shell in CrowdStrike LogScale
Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations exist (sh, ash, bash, zsh, etc.). Unix shells can control every aspect of a system, with certain commands requiring elevated privileges. Adversaries may abuse Unix shells to execute various commands or payloads, access interactive shells through C2 channels, leverage shell scripts for persistence, or use stripped-down shells via Busybox on embedded devices and ESXi servers.
MITRE ATT&CK
- Tactic
- Execution
- Technique
- T1059 Command and Scripting Interpreter
- Sub-technique
- T1059.004 Unix Shell
- Canonical reference
- https://attack.mitre.org/techniques/T1059/004/
LogScale Detection Query
#event_simpleName=ProcessRollup2
| FileName = /^(bash|sh|zsh|dash|ash|ksh|csh|tcsh|busybox)$/
| CommandLine = /\/dev\/(tcp|udp)\/\d+\.\d+|bash\s+-i\s+>&\s+\/dev\/tcp|nc(at)?\s+-e\s+\/bin\/|socat\s+exec:|curl.+\|\s*(ba)?sh|wget.+\|\s*(ba)?sh|base64\s+(--decode|-d)|mkfifo\s+\/tmp\/|mknod\s+\/tmp\/|chmod\s+(\+s|4755|u\+s)|useradd|usermod\s+-aG|iptables\s+(-F|-P\s+ACCEPT)|python3?\s+-c\s+['"]import socket|perl\s+-e\s+['"]use Socket/
| eval ReverseShell := CommandLine = /\/dev\/(tcp|udp)\// OR CommandLine = /bash\s+-i\s+>&\s+\/dev\/tcp/ OR CommandLine = /nc(at)?\s+-e\s+\/bin\// OR CommandLine = /socat\s+exec:/
| eval CurlPipe := CommandLine = /curl.+\|\s*(ba)?sh/ OR CommandLine = /wget.+\|\s*(ba)?sh/
| eval Base64Decode := CommandLine = /base64\s+(--decode|-d)/
| eval PrivEsc := CommandLine = /chmod\s+(\+s|4755|u\+s)/ OR CommandLine = /useradd/ OR CommandLine = /usermod\s+-aG/ OR CommandLine = /iptables\s+(-F|-P\s+ACCEPT)/
| eval NamedPipe := CommandLine = /mkfifo\s+\/tmp\// OR CommandLine = /mknod\s+\/tmp\//
| eval PythonShell := CommandLine = /python3?\s+-c\s+['"]import socket/ OR CommandLine = /perl\s+-e\s+['"]use Socket/
| eval SuspicionScore := (if(ReverseShell, 3, 0)) + (if(CurlPipe, 2, 0)) + (if(Base64Decode, 1, 0)) + (if(PrivEsc, 2, 0)) + (if(NamedPipe, 1, 0)) + (if(PythonShell, 2, 0))
| where SuspicionScore > 0
| groupBy([ComputerName, UserName, FileName, CommandLine, ReverseShell, CurlPipe, Base64Decode, PrivEsc, NamedPipe, PythonShell, SuspicionScore], function=collect([TargetProcessId, timestamp]))
| sort(SuspicionScore, order=desc)Detects suspicious Unix shell execution on Linux endpoints via CrowdStrike Falcon's ProcessRollup2 events. Applies weighted suspicion scoring across six indicator categories: reverse shell (/dev/tcp, nc -e, socat exec), pipe-to-shell (curl/wget | bash), base64 decode, privilege escalation (chmod SUID, useradd, iptables flush), named pipe creation (mkfifo/mknod), and Python/Perl socket-based shells. Surfaces all hits with category breakdown.
Data Sources
Required Tables
False Positives & Tuning
- Linux server provisioning tools (cloud-init, Ansible, Puppet) that run base64-encoded configuration scripts or invoke shell interpreters with complex argument chains during instance initialization
- Container orchestration systems where init containers or sidecar processes run shell scripts with patterns that resemble reverse shell syntax (e.g., health check scripts using /dev/tcp for TCP probing)
- Developers and data engineers using Python one-liners with socket imports for legitimate network utility scripts or API clients on developer workstations
Other platforms for T1059.004
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Bash Reverse Shell via /dev/tcp
Expected signal: Auditd: EXECVE record for bash with /dev/tcp in arguments. Syslog: bash process creation. Network connection attempt to 127.0.0.1:4444 (will fail without listener). MDE DeviceProcessEvents on managed Linux endpoints.
- Test 2Curl Pipe to Bash
Expected signal: Auditd: EXECVE records for curl and bash. Process tree shows curl piped to bash. Network connection attempt to 127.0.0.1:8080 (will fail without listener). The curl failure means no content reaches bash.
- Test 3Base64 Encoded Command Execution
Expected signal: Auditd: EXECVE records for echo, base64, and bash. The decoded content 'whoami' will be executed. Syslog captures the process chain.
Unlock Pro Content
Get the full detection package for T1059.004 including response playbook, investigation guide, and atomic red team tests.