{"source_checked_on":"2026-10-19","schema_version":1,"key":"ics/T1701.003","id":"T1701.003","name":"Unix Shell","domain":"ics","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1701/003","source_file":{"file":"ics.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/ics-attack/ics-attack-20.0.json","sha256":"c9ca0ce523a1b5e512060a390415e8aefe8f6d32c5f82d7de81264960c1e1183","bytes":5266683},"source_object_sha256":"5a96ad16587c9ec3d08225a98aea2928c83a70cc721dc40387fdc21c79106b6b","description":"Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution.(Citation: DieNet Bash)(Citation: Apple ZShell) Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.\n\nUnix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops. Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems.\n\nAdversaries may abuse Unix shells to execute various commands or payloads. Interactive shells may be accessed through command and control channels or during lateral movement such as with [Remote Services](https://attack.mitre.org/techniques/T0886). Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence.\n\nWithin Industrial control system networks, workstations, control servers, hypervisors, networking devices, and embedded devices that run on linux platforms may allow for Unix command shell access or stripped-down shells to implement a subset of commands. Industrial automation equipment generally does not offer command shells as a native user interface.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1701/003","external_id":"T1701.003"},{"source_name":"Apple ZShell","description":"Apple. (2020, January 28). Use zsh as the default shell on your Mac. Retrieved June 12, 2020.","url":"https://support.apple.com/HT208050"},{"source_name":"DieNet Bash","description":"die.net. (n.d.). bash(1) - Linux man page. Retrieved June 12, 2020.","url":"https://linux.die.net/man/1/bash"}],"platforms":[],"environments":["ics-ot"],"visibility":"source_mapped","visibility_note":null,"parent":{"key":"ics/T1701","id":"T1701","name":"Command and Scripting Interpreter","domain":"ics","level":"technique","parent_id":null,"tactics":["execution"],"platforms":[],"environments":["ics-ot"],"page":"techniques/ics/T1701/","constraints":["isolated_authorized_lab","procedure_review_required","telemetry_configuration_required","ot_fixture_and_process_safety_review"],"telemetry_tags":["Command Execution","Process Creation"],"telemetry_references":[{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"detections":{"page":"detections/ics/T1701/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},"detection_status":"guidance_only","anomaly_tags":[],"tool_tags":[],"tool_references":[],"visibility":"source_mapped","telemetry_status":"mapped","classification":"cannot_simulate_yet","candidate_count":0,"implementation":"not_integrated","methods":[]},"children":[],"telemetry":[{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0067","name":"Logon Session Creation","page":"telemetry/DC0067/","kind":"attack_component","category":"Windows and directory audit","description":"Creation of a logon session with account and logon-type context.","collection_focus":"Enable Audit Logon and collect successful session creation on the receiving host; join session/logon IDs rather than only account names.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["account","logon_id","logon_type","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0067","collector":"illustrative-lab-collector","observation":{"account":"LAB\\analyst","logon_id":"0x12345","logon_type":3,"source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"ics/T1701.003","id":"T1701.003","name":"Unix Shell","domain":"ics","platforms":[],"environments":["ics-ot"],"source_url":"https://attack.mitre.org/techniques/T1701/003","technique_page":"techniques/ics/T1701.003/","page":"detections/ics/T1701.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0931","name":"Behavioral Detection of Unix Shell Execution in ICS","url":"https://attack.mitre.org/detectionstrategies/DET0931","stix_id":"x-mitre-detection-strategy--02744e21-5d1c-4290-820f-d355fc044f50","relationship_id":"relationship--b3450c17-37c7-4ae1-be7a-21ed8680a0f7","description":"","analytics":[{"id":"AN2088","name":"Analytic 2088","guidance":"Real-time monitoring identifies sh/bash/ash/zsh/BusyBox execution from an unexpected parent, unauthorized account, remote session, or non-approved script path, particularly when followed by OT-relevant network discovery, persistence, file modification, or communications. Alert only when the interpreter/shell is not expected for the asset role or user/service context, or when its parent, path, arguments, remote-session source, or follow-on behavior violates the approved OT baseline. Suppress approved engineering scripts, vendor support, diagnostics, backup, patching, and maintenance windows.","url":"https://attack.mitre.org/detectionstrategies/DET0931#AN2088","platforms":["Linux"],"tuning":[{"field":"ShellExecutable","description":"Approved shell paths and BusyBox use"},{"field":"ParentProcess","description":"Expected service/vendor parents"},{"field":"UserContext","description":"Authorized users and service accounts"},{"field":"RemoteSource","description":"Approved jump hosts and management subnets "},{"field":"CommandLinePattern","description":"High-risk shell commands and ICS-relevant follow-on activity "}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve for shell/interpreter and child commands ","platforms":["Linux"],"analytic_id":"AN2088","source_url":"https://attack.mitre.org/detectionstrategies/DET0931#AN2088","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0067","component":"Logon Session Creation","name":"linux:syslog","channel":"auth.log/secure.log; SSH or console session context ","platforms":["Linux"],"analytic_id":"AN2088","source_url":"https://attack.mitre.org/detectionstrategies/DET0931#AN2088","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0067/"}]},{"id":"AN2089","name":"Analytic 2089","guidance":"Real-time monitoring identifies network-device CLI or underlying Unix-like shell access from an unauthorized management source/account, followed by privileged or configuration commands outside an approved change window. Do not alert solely on CLI use. Require violation of the management matrix, command authorization, or change-control context.","url":"https://attack.mitre.org/detectionstrategies/DET0931#AN2089","platforms":["Network Devices"],"tuning":[{"field":"ApprovedManagementSources ","description":"Jump hosts, management VLANs, and administrative CIDRs "},{"field":"AuthorizedAccounts ","description":"Named/network-service administrative accounts "},{"field":"HighRiskCommands ","description":"Enable/configure, ACL, route, NAT, firmware, file transfer, shell escape "},{"field":"ChangeWindow ","description":"Approved network maintenance/change ticket window "}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"networkdevice:syslog","channel":"CLI command audit / configuration command history","platforms":["Network Devices"],"analytic_id":"AN2089","source_url":"https://attack.mitre.org/detectionstrategies/DET0931#AN2089","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0067","component":"Logon Session Creation","name":"networkdevice:auth","channel":"SSH/Telnet/console authentication and session creation","platforms":["Network Devices"],"analytic_id":"AN2089","source_url":"https://attack.mitre.org/detectionstrategies/DET0931#AN2089","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0067/"}]},{"id":"AN2090","name":"Analytic 2090","guidance":"Real-time monitoring identifies shell/CLI access to an embedded controller, gateway, HMI appliance, or IoT/OT device from an unauthorized source/account, or command execution that is inconsistent with the device role and approved maintenance workflow. Require a session/command authorization violation or corroborating configuration/firmware/process effect; do not infer maliciousness from deterministic timing alone.","url":"https://attack.mitre.org/detectionstrategies/DET0931#AN2090","platforms":["Embedded"],"tuning":[{"field":"ApprovedManagementSources ","description":"Engineering workstations/jump hosts permitted to administer the device "},{"field":"AuthorizedAccounts ","description":"Approved local/vendor accounts "},{"field":"HighRiskCommands ","description":"Firmware, configuration write/erase, service manipulation, shell escape "},{"field":"DeviceRole ","description":"Whether interactive shell/CLI is expected on this device class "},{"field":"MaintenanceWindow ","description":"Approved vendor/engineering activity "}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"device:CLI","channel":"Device shell/CLI command audit when available ","platforms":["Embedded"],"analytic_id":"AN2090","source_url":"https://attack.mitre.org/detectionstrategies/DET0931#AN2090","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0067","component":"Logon Session Creation","name":"device:auth","channel":"SSH/Telnet/console or vendor remote-management session ","platforms":["Embedded"],"analytic_id":"AN2090","source_url":"https://attack.mitre.org/detectionstrategies/DET0931#AN2090","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0067/"}]}]}],"telemetry_references":[{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0067","name":"Logon Session Creation","tag":"Logon Session Creation","page":"telemetry/DC0067/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S9046","name":"IOControl","url":"https://attack.mitre.org/software/S9046","kind":"malware","description":"IOCONTROL has executed arbitrary commands using system calls as well as scripts with the UNIX Shell.(Citation: Claroty-IOCONTROL)","relationship_id":"relationship--d304ae90-33b1-4cfe-b60e-6c93780f4bf9","references":[{"source_name":"Claroty-IOCONTROL","description":"Claroty Team82. (2024, December 10). Inside a New OT/IoT Cyberweapon: IOCONTROL. Retrieved September 2, 2026.","url":"https://claroty.com/team82/research/inside-a-new-ot-iot-cyber-weapon-iocontrol"}]}],"actors":[],"mitigations":[{"id":"M0938","name":"Execution Prevention","url":"https://attack.mitre.org/mitigations/M0938","kind":"course-of-action","description":"Restrict interactive and scripted shell execution on Linux, network, and embedded ICS assets to approved accounts, management paths, commands, and vendor workflows. Where full application control is unavailable, constrain SSH/Telnet access and privileged shell use to dedicated administration paths. ","relationship_id":"relationship--13a0693c-6297-4221-babc-c8cfce904b13","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use a process simulator or isolated test rig with no connection to production controllers or physical actuators. Preserve safety interlocks; destructive effects require synthetic evidence, not real equipment damage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T0886":"/ttp-simulation/techniques/ics/T0886/","T1701.003":"/ttp-simulation/techniques/ics/T1701.003/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"ics/T1701.003","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0067","collector":"illustrative-lab-collector","observation":{"account":"LAB\\analyst","logon_id":"0x12345","logon_type":3,"source_ip":"192.0.2.10"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}