Loading interactive filters…

1200KM / detection

T1059 Command and Scripting Interpreter — Detection Rules

Detection workspace for T1059 Command and Scripting Interpreter: 75 Sigma sources, 1 Atlas concepts and 1 anomaly models. No live detection validation.

Source-backed rule directory

Azure New CloudShell Created · test · medium · {"product":"azure","service":"activitylogs"}
BPFDoor Abnormal Process ID or Lock File Accessed · test · high · {"product":"linux","service":"auditd"}
Suspicious Invocation of Shell via AWK - Linux · test · high · {"category":"process_creation","product":"linux"}
Capsh Shell Invocation - Linux · test · high · {"category":"process_creation","product":"linux"}
Shell Execution via Git - Linux · test · high · {"category":"process_creation","product":"linux"}
Potential Netcat Reverse Shell Execution · test · high · {"category":"process_creation","product":"linux"}
Python Spawning Pretty TTY Via PTY Module · test · medium · {"category":"process_creation","product":"linux"}
Inline Python Execution - Spawn Shell Via OS System Library · test · high · {"category":"process_creation","product":"linux"}
Shell Execution via Rsync - Linux · experimental · high · {"category":"process_creation","product":"linux"}
Suspicious Invocation of Shell via Rsync · experimental · high · {"category":"process_creation","product":"linux"}
Shell Invocation Via Ssh - Linux · test · high · {"category":"process_creation","product":"linux"}
Suspicious Java Children Processes · test · high · {"category":"process_creation","product":"linux"}
Vim GTFOBin Abuse - Linux · test · high · {"category":"process_creation","product":"linux"}
Potential Xterm Reverse Shell · test · medium · {"category":"process_creation","product":"linux"}
Suspicious Installer Package Child Process · test · medium · {"category":"process_creation","product":"macos"}
Payload Decoded and Decrypted via Built-in Utilities · test · medium · {"category":"process_creation","product":"macos"}
Suspicious Browser Child Process - MacOS · test · medium · {"category":"process_creation","product":"macos"}
Suspicious Execution via macOS Script Editor · test · medium · {"category":"process_creation","product":"macos"}
Hacktool Ruler · test · high · {"product":"windows","service":"security"}
Windows Defender AMSI Trigger Detected · stable · high · {"product":"windows","service":"windefend"}
Windows Defender Threat Detected · stable · high · {"product":"windows","service":"windefend"}
PCRE.NET Package Temp Files · test · high · {"category":"file_event","product":"windows"}
Suspicious File Created In PerfLogs · test · medium · {"category":"file_event","product":"windows"}
Windows Shell/Scripting Application File Write to Suspicious Folder · test · high · {"category":"file_event","product":"windows"}
Clfs.SYS Loaded By Process Located In a Potential Suspicious Location · experimental · medium · {"category":"image_load","product":"windows"}
PCRE.NET Package Image Load · test · high · {"category":"image_load","product":"windows"}
Abusable DLL Potential Sideloading From Suspicious Location · test · high · {"category":"image_load","product":"windows"}
Windows Defender Exclusions Added - PowerShell · test · medium · {"category":"ps_script","product":"windows","definition":"Requirements: Script Block Logging must be enabled"}
Suspicious ArcSOC.exe Child Process · experimental · high · {"category":"process_creation","product":"windows"}
Potential Dosfuscation Activity · test · medium · {"category":"process_creation","product":"windows"}
Unusual Parent Process For Cmd.EXE · test · medium · {"category":"process_creation","product":"windows"}
Conhost Spawned By Uncommon Parent Process · test · medium · {"category":"process_creation","product":"windows"}
Deno Runtime Spawns Shell Or Scripting Interpreter · experimental · medium · {"product":"windows","category":"process_creation"}
Forfiles Command Execution · test · medium · {"category":"process_creation","product":"windows"}
Use of FSharp Interpreters · test · medium · {"category":"process_creation","product":"windows"}
Potentially Suspicious NTFS Symlink Behavior Modification · test · medium · {"category":"process_creation","product":"windows"}
Potential Arbitrary Command Execution Via FTP.EXE · test · medium · {"category":"process_creation","product":"windows"}
Potential CobaltStrike Process Patterns · test · high · {"category":"process_creation","product":"windows"}
HackTool - Sliver C2 Implant Activity Pattern · test · critical · {"category":"process_creation","product":"windows"}
HackTool - Stracciatella Execution · test · high · {"category":"process_creation","product":"windows"}
Use of OpenConsole · test · medium · {"category":"process_creation","product":"windows"}
Use of Pcalua For Execution · test · medium · {"category":"process_creation","product":"windows"}
Suspicious Runscripthelper.exe · test · medium · {"category":"process_creation","product":"windows"}
Wscript Shell Run In CommandLine · test · medium · {"category":"process_creation","product":"windows"}
Outlook EnableUnsafeClientMailRules Setting Enabled · test · high · {"category":"process_creation","product":"windows"}
Suspicious Remote Child Process From Outlook · test · high · {"category":"process_creation","product":"windows"}
Perl Inline Command Execution · test · medium · {"category":"process_creation","product":"windows"}
Php Inline Command Execution · test · medium · {"category":"process_creation","product":"windows"}
PowerShell Download and Execution Cradles · test · high · {"product":"windows","category":"process_creation"}
Run PowerShell Script from Redirected Input Stream · test · high · {"category":"process_creation","product":"windows"}
PUA - Wsudo Suspicious Execution · test · high · {"category":"process_creation","product":"windows"}
Python Inline Command Execution · test · medium · {"category":"process_creation","product":"windows"}
Python Spawning Pretty TTY on Windows · test · high · {"category":"process_creation","product":"windows"}
Suspicious Greedy Compression Using Rar.EXE · test · high · {"product":"windows","category":"process_creation"}
Suspicious RASdial Activity · test · medium · {"category":"process_creation","product":"windows"}
Renamed CURL.EXE Execution · test · medium · {"category":"process_creation","product":"windows"}
Renamed FTP.EXE Execution · test · medium · {"category":"process_creation","product":"windows"}
Renamed NirCmd.EXE Execution · test · high · {"category":"process_creation","product":"windows"}
Renamed PingCastle Binary Execution · test · high · {"category":"process_creation","product":"windows"}
Ruby Inline Command Execution · test · medium · {"category":"process_creation","product":"windows"}
Elevated System Shell Spawned From Uncommon Parent Location · test · medium · {"product":"windows","category":"process_creation"}
Potentially Suspicious Execution From Parent Process In Public Folder · test · high · {"category":"process_creation","product":"windows"}
Writing Of Malicious Files To The Fonts Folder · test · medium · {"product":"windows","category":"process_creation"}
Suspicious Scan Loop Network · test · medium · {"category":"process_creation","product":"windows"}
Suspicious Program Names · test · high · {"category":"process_creation","product":"windows"}
Script Interpreter Execution From Suspicious Folder · test · high · {"category":"process_creation","product":"windows"}
Sysprep on AppData Folder · test · medium · {"category":"process_creation","product":"windows"}
Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script · test · medium · {"category":"process_creation","product":"windows"}
Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script · test · high · {"category":"process_creation","product":"windows"}
VMToolsd Suspicious Child Process · test · high · {"category":"process_creation","product":"windows"}
Add New Download Source To Winget · test · medium · {"category":"process_creation","product":"windows"}
Add Insecure Download Source To Winget · test · high · {"category":"process_creation","product":"windows"}
Add Potential Suspicious New Download Source To Winget · test · medium · {"category":"process_creation","product":"windows"}
Install New Package Via Winget Local Manifest · test · medium · {"category":"process_creation","product":"windows"}
Installation of WSL Kali-Linux · experimental · high · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

T1059 Command and Scripting Interpreter

MATCH(process_name IN command_interpreters) AND command_line MATCHES suspicious_argument_patterns -> ALERT

Anomaly models

Command or scripting interpreter execution — T1059 Command and Scripting Interpreter

Comparison unit: user, host, and process lineage.

Expected behavior: interpreters are launched by recurring parents with familiar arguments.

Deviation: rare parent-interpreter edge, first-seen argument pattern, or unusual execution rate.

ATT&CK analytic guidance

DET0516 Behavioral Detection of Command and Scripting Interpreter Abuse

AN1428 Analytic 1428

Detects the execution of scripting or command interpreters (e.g., powershell.exe, cmd.exe, wscript.exe) outside expected administrative time windows or from abnormal user contexts, often followed by encoded/obfuscated arguments or secondary execution events.

AN1429 Analytic 1429

Detects use of shell interpreters (e.g., bash, sh, python, perl) initiated by users or processes not normally executing them, especially when chaining suspicious utilities like netcat, curl, or ssh.

AN1430 Analytic 1430

Detects launch of command-line interpreters via Terminal, Automator, or hidden `osascript`, especially when parent process lineage deviates from user-initiated applications.

AN1431 Analytic 1431

Detects use of 'esxcli system' or direct interpreter commands (e.g., busybox shell) invoked from SSH or host terminal unexpectedly.

AN1432 Analytic 1432

Identifies CLI interpreter access (e.g., Cisco IOS, Juniper JUNOS) via `enable` mode or scripting-capable sessions used by uncommon accounts or from unknown IPs.

Connected ecosystem references

Simulation, tools and telemetry

T1059 simulation workspace

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing anomaly research

Original publication snapshot · Anomaly Detection Atlas

Connected anomaly research

Curated research views reached through an exact source technique, a catalog model, or a reviewed collection reference. These are navigation associations, not claims of detector effectiveness or sensor equivalence.

Rare Process / Service

Telemetry contracts · Maintained query examples · Validation and blind spots

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.