Techniques › T1204.004 › AN0963
AN0963 Analytic 0963
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>User pastes a multi-line or one-liner into a terminal (bash/zsh) that downloads/decodes and executes content. Chain: terminal exec of curl/wget/bash/sh with pipe to interpreter or base64-decode → transient file under /tmp|~/.cache → immediate outbound egress.</p>
- Detects
- T1204.004 Malicious Copy and Paste
- Part of
- DET0340 User Execution – Malicious Copy & Paste (browser/email → shell with obfuscated one-liner) – T1204.004
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | execve: exe in (/usr/bin/bash,/usr/bin/sh,/usr/bin/zsh,/usr/bin/python*) AND cmdline matches '(curl|wget).*(\||\|\s*sh|bash)|base64\s*-d|python\s*-c' | DC0032 Process Creation |
| auditd:SYSCALL | open: File creation under /tmp, /var/tmp, ~/.cache with executable bit or shell shebang | DC0039 File Creation |
| NSM:Flow | New egress to Internet by the same UID/host shortly after terminal exec | DC0082 Network Connection Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TerminalProcessNames | Gui/tty terminals to monitor (gnome-terminal, konsole, iTerm2, tmux). |
RiskyFilePaths | Temp/cache paths to watch for first-stage drops. |
AnomalousUserSet | Users who should never run curl/wget or compilers. |
TimeWindow | Exec→file→egress correlation window (e.g., 10 minutes). |