Command and Scripting Interpreter: Unix Shell

Anchor can execute payloads via shell scripting.^[3]

AppleJeus has used shell scripts to execute commands after installation and set persistence mechanisms.^[4]

APT41 executed file /bin/pwd in activity exploiting CVE-2019-19781 against Citrix devices.^[5]

Bundlore has leveraged /bin/sh and /bin/bash to execute commands on the victim machine.^[6]

CallMe has the capability to create a reverse shell on victims.^[7]

Chaos provides a reverse shell connection on 8338/TCP, encrypted via AES.^[8]

CoinTicker executes a bash script to establish a reverse shell.^[9]

CookieMiner has used a Unix shell script to run a series of commands targeting macOS.^[10]

Derusbi is capable of creating a remote Bash shell and executing commands.^[11][12]

Doki has executed shell scripts with /bin/sh.^[13]

Drovorub can execute arbitrary commands as root on a compromised system.^[14]

Exaramel for Linux has a command to execute a shell command on the system.^[15][16]

Fysbis has the ability to create and execute commands in a remote shell for CLI.^[17]

Hildegard has used shell scripts for execution.^[18]

Kazuar uses /bin/bash to execute commands on the victim’s machine.^[19]

Kinsing has used Unix shell scripts to execute commands in the victim environment.^[20]

Kobalos can spawn a new pseudo-terminal and execute arbitrary commands at the command prompt.^[21]

LoudMiner used shell scripts to launch various services and to start/stop the QEMU virtualization.^[22]

NETWIRE has the ability to use /bin/bash and /bin/sh to execute commands.^[23][24]

OSX/Shlayer can use bash scripts to check the macOS version, download payloads, and extract bytes from files. OSX/Shlayer uses the command sh -c tail -c +1381... to extract bytes at an offset from a specified file. OSX/Shlayer uses the curl -fsL "$url" >$tmp_path command to download malicious payloads into a temporary directory.^{[25][26][27][28]}

OSX_OCEANLOTUS.D uses a shell script as the main executable inside an app bundle and drops an embedded base64-encoded payload to the /tmp folder.^[29][30]

Penquin can execute remote commands using bash scripts.^[31]

Proton uses macOS' .command file type to script actions.^[32]

Rocke used shell scripts to run commands which would obtain persistence and execute the cryptocurrency mining malware.^[33]

Skidmap has used pm.sh to download and install its main payload.^[34]

TeamTNT has used shell scripts for execution.^[35]

Turian has the ability to use /bin/sh to execute commands.^[36]

WindTail can use the open command to execute an application.^[37]

XCSSET uses a shell script to execute Mach-o files and osacompile commands such as, osacompile -x -o xcode.app main.applescript.^[38]

Use application control where appropriate.