Command-Line Interface
| Command-Line Interface | |
|---|---|
| Technique | |
| ID | T807 |
| Tactic | Execution |
| Data Sources | Process monitoring, Process command-line parameters, Network protocol analysis, Packet capture |
Description
Adversaries may utilize command-line interfaces (CLIs) to interact with systems and execute commands. CLIs provide a means of interacting with computer systems and are a common feature across many types of platforms and devices within control systems environments.1 Adversaries may also use CLIs to install and run new software, including malicious tools that may be installed over the course of an operation.
CLIs are typically accessed locally, but can also be exposed via services, such as SSH, Telnet, and RDP. Commands that are executed in the CLI execute with the current permissions level of the process running the terminal emulator, unless the command specifies a change in permissions context.
Many controllers have CLI interfaces for management purposes.
Procedure Examples
- The name of the Industroyer payload DLL is supplied by the attackers via a command line parameter supplied in one of the main backdoor’s “execute a shell command” commands.2
Mitigation
- Restrict access to control room(s), portable devices, and removable media, which should be locked down and physically secured.3
- Authentication of accounts should be enforced, and when applicable, account permissions and privileges should be limited to an as-needed basis.3
- In ICS environments with dial-up modems, disconnect the modems when not in use or automate their disconnection after being active for a given amount of time, if feasible.3
- In general, reduce and restrict access to both physical resources and the network, wherever CLIs might be exposed.3
References
