1200KM / detection
T1701.003 Unix Shell — Detection Rules
Detection workspace for T1701.003 Unix Shell: 0 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
No reviewed association in this snapshot.
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0931 Behavioral Detection of Unix Shell Execution in ICS
AN2088 Analytic 2088
Real-time monitoring identifies sh/bash/ash/zsh/BusyBox execution from an unexpected parent, unauthorized account, remote session, or non-approved script path, particularly when followed by OT-relevant network discovery, persistence, file modification, or communications. Alert only when the interpreter/shell is not expected for the asset role or user/service context, or when its parent, path, arguments, remote-session source, or follow-on behavior violates the approved OT baseline. Suppress approved engineering scripts, vendor support, diagnostics, backup, patching, and maintenance windows.
AN2089 Analytic 2089
Real-time monitoring identifies network-device CLI or underlying Unix-like shell access from an unauthorized management source/account, followed by privileged or configuration commands outside an approved change window. Do not alert solely on CLI use. Require violation of the management matrix, command authorization, or change-control context.
AN2090 Analytic 2090
Real-time monitoring identifies shell/CLI access to an embedded controller, gateway, HMI appliance, or IoT/OT device from an unauthorized source/account, or command execution that is inconsistent with the device role and approved maintenance workflow. Require a session/command authorization violation or corroborating configuration/firmware/process effect; do not infer maliciousness from deterministic timing alone.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
T1701.003 simulation workspace
No reviewed association in this snapshot.
Existing anomaly research
Complete technique engineering workbook
Collection configuration and event examples · Anomaly models and design worksheet · Tools and documented software · Simulation procedures · Offline synthetic collection check
Exact source tags are not semantic relevance verdicts. Review actual rule conditions and observation points; imported rules are not backend-compiled or live-validated.
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.