ATT&CK Technique · Execution
T1059.004 Unix ShellMapped by 7 reports, 21 detection rules and 10 tracked actors on The Hunters Ledger. Technique page on attack.mitre.org.
← All techniques and the coverage heatmap
Reports
Each report maps this technique in its own ATT&CK table, at the confidence the report states. The link opens that table.
Detection rules
Rules whose ATT&CK coverage line names this technique, by detection page. The link opens the page's coverage table.
Detection rules
Gotenberg CVE-2026-42589 Mass Exploitation and CryptominingExifTool Invoked With Condition Option Executing Shell Commands (SIGMA, Detection); Pkill Kill Sweep Against Rival Cryptominer Process Names (SIGMA, Hunting); Base64 Decoded Script Written to Tmp and Executed by Bash (SIGMA, Hunting)
Detection rules
Carrier Credential Harvesting Through a Customer's RouterJava Process Spawns Unix Shell Following WebLogic JNDI Exploitation (SIGMA, Detection)
Detection rules
Multi-Actor AI-Agent Framework Abuse (8 Operators)Pandora/Mirai Naku Architecture Naming Pattern (YARA, Detection)
Detection rules
Korean Claude Code + OpenClaw Operator (221.150.15.104)OpenClaw-Specific Claude Code Allowlist (YARA, Detection); Generic Curl-Pipe-Bash Pattern in Claude Code Allowlist (YARA, Hunting); OpenClaw Curl-Pipe-Bash Installer Execution (SIGMA, Hunting)
Detection rules
Rovodev AI-Co-Authored Mirai Variant + Matrix C2 (87.106.143.220)MAL_Bash_Pandora_Dropper_Family (YARA, Detection); MAL_Python_Persistent_Bot_DualChannel_CNC (YARA, Detection); ELF IoT Arch-Tagged Filename Execution on Linux Server: Naku/Pandora Mirai Family (SIGMA, Detection); BusyBox SORA Marker Execution: Sora-Derivative Mirai-Fork Active on Host (SIGMA, Detection); PandoraNet Botnet ID in Process Command Line: Active Pandora-Mirai Infection (SIGMA, Hunting)
Detection rules
GHOST Cryptojacker Kit — Vova75Rus Supply Chain (77.110.96.200)MAL_Linux_GHOST_Kit_Shell_Installer (YARA, Detection); MAL_Linux_GHOST_Hysteria_Operator_Wrapper (YARA, Hunting); MAL_Linux_GHOST_min1_DualTelegram_Wrapper (YARA, Hunting); MAL_Linux_GHOST_check_comfyui_Scanner (YARA, Hunting); MAL_Linux_GHOST_get_all_ranges_CloudEnumerator (YARA, Hunting); Suspicious LD_PRELOAD Set to Non-Standard Library Path (SIGMA, Hunting); High-Frequency Ncat Listener Creation on Linux Host (SIGMA, Hunting); GHOST Kit Distribution File Download from AEZA Hosting Range (SURICATA, Detection)
Tracked actors
Designations whose reports map this technique.
- UTA-2026-008: Developer and operator of the BellaMain Turkish phishing-as-a-service panel
- UTA-2026-011: Financially motivated operator weaponising a cPanel authentication bypass with a custom harvesting toolkit
- UTA-2026-014: DDoS-for-hire operator running an AI co-authored C2 framework over a Pandora-Mirai botnet
- UTA-2026-015: Operator running Claude Code and OpenClaw side by side, observed at capsule depth only
- UTA-2026-016: GHOST cryptojacker kit customer (operator A) with self-hosted mining pool proxies
- UTA-2026-017: GHOST cryptojacker kit customer (operator B) using public mining pools, host abandoned
- UTA-2026-018: Hands-on-keyboard operator exploiting four Southeast Asian governments with a bespoke edge-device toolkit
- UTA-2026-019: Grey-market personal-data harvester running scores of LLM-assisted attack scripts against Chinese consumer platforms
- UTA-2026-020: Self-branded commodity cryptojacking operator mass-exploiting exposed Chinese enterprise software
- UTA-2026-023: Telecom-focused operator reaching a carrier's credential plane through a customer's managed router
ATT&CK v19.2. MITRE ATT&CK® is a registered trademark of The MITRE Corporation; technique names are MITRE's and link to MITRE's own pages. The mapping on each linked page is this publication's reading of its own evidence.