AN0238: Analytic 0238
Detection of suspicious use of shell utilities or scripts that decode or decrypt a payload and execute it without writing to disk.
Analyst context for executives and security teams
This analytic matters because it focuses on Linux activity where shell utilities or scripts decode or decrypt a payload and run it without writing the payload to disk. For leaders, the practical risk is that controls and investigations depending mainly on file creation or malware-on-disk evidence may miss important execution activity.
Executive priority
Prioritize this as a validation point for Linux monitoring depth and incident response readiness. Security leaders should ask whether SOC telemetry can show suspicious command execution, script behavior, and in-memory-style payload execution patterns, not just file-based alerts. It is also useful audit evidence for demonstrating that monitoring covers evasive execution behaviors beyond traditional endpoint file scanning.
Technical view
SOC and detection teams should validate Linux visibility for shell and script execution where commands decode or decrypt content and immediately execute it. Because no official detection logic or ATT&CK tactic is supplied, teams should treat this as a detection engineering requirement rather than a ready rule. Validate command-line capture, process lineage, interpreter activity, and script execution context; then tune against known administrative automation to reduce false positives.
Likely telemetry
- Linux process execution events
- Command-line arguments
- Parent-child process relationships
- Shell and script interpreter activity
- Endpoint detection and response telemetry for Linux
Detection direction
- Confirm that Linux hosts collect full command-line and process lineage data, since file-write telemetry alone may not expose this behavior.
- Look for suspicious combinations of shell utilities or scripts that decode or decrypt content and pass it directly into execution.
- Baseline legitimate administrative scripts, deployment tooling, and automation frameworks that may perform encoding or decoding to reduce false positives.
- Test whether the SOC can investigate execution chains even when no decoded payload file is present on disk.
- Document gaps where command-line logging, script visibility, or Linux endpoint coverage is incomplete.
Mitigation priorities
- Improve Linux endpoint and audit telemetry before relying on this analytic for operational coverage.
- Restrict unnecessary script interpreter and shell utility use where business operations allow.
- Apply least privilege for accounts running shell scripts or automation on Linux systems.
- Review administrative automation patterns so approved encoded or encrypted script workflows are known and documented.
- Ensure incident response playbooks account for payload execution without recoverable files on disk.
Analyst notes and limits
The supplied ATT&CK object is a detection analytic for Linux only. It has no supplied relationships, no official detection query, and no specified tactic, so this take focuses on defensive validation and telemetry readiness rather than a specific rule implementation.
Assessment is limited to the supplied official fields and external reference. Local environment data is required to determine actual exposure, expected administrative behavior, false-positive rates, and detection coverage.
Analytic 0238
Detection of suspicious use of shell utilities or scripts that decode or decrypt a payload and execute it without writing to disk.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | 94cb41178db8… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack AN0238Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.