Command and Scripting Interpreter: Container CLI/API `T1059.013`

Tactic: Execution

Adversaries may abuse built-in CLI tools or API calls to execute malicious commands in containerized environments.

Events covered

1 catalog event is tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon-for-Linux	Event ID 1	Process Create

These 1 rule share fields, values, and exclusions.

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`CommandLine`	1	`contains` 1, `in` 1	`exec` , `* /bin/bash `, ` /bin/dash *`
`process_name`	1	`starts_with` 1	`docker`

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`CommandLine`	`contains`	`exec` splunkLinux Docker Shell Execution	1	3
`CommandLine`	`in`	`* /bin/bash *` splunkLinux Docker Shell Execution	1
`CommandLine`	`in`	`* /bin/dash *` splunkLinux Docker Shell Execution	1
`CommandLine`	`in`	`* /bin/sh *` splunkLinux Docker Shell Execution	1
`CommandLine`	`in`	`* /bin/zsh *` splunkLinux Docker Shell Execution	1
`CommandLine`	`in`	`* bash` splunkLinux Docker Shell Execution	1
`CommandLine`	`in`	`* bash *` splunkLinux Docker Shell Execution	1
`CommandLine`	`in`	`* dash` splunkLinux Docker Shell Execution	1
`CommandLine`	`in`	`* dash *` splunkLinux Docker Shell Execution	1
`CommandLine`	`in`	`* sh` splunkLinux Docker Shell Execution	1
`CommandLine`	`in`	`* sh *` splunkLinux Docker Shell Execution	1
`CommandLine`	`in`	`* zsh` splunkLinux Docker Shell Execution	1
`CommandLine`	`in`	`* zsh *` splunkLinux Docker Shell Execution	1
`process_name`	`starts_with`	`docker` splunkLinux Docker Shell Execution	1	2

These vendors publish rules tagged with this technique.

Platform: Linux

Domain: Endpoint