2025 Poland Wiper AttacksC0063 ↗
During the 2025 Poland Wiper Attacks, the adversaries leveraged the native CLI of the targeted FortiGate device.1
tfMITRE ATT&CK sub-technique
Network Device CLI T1059.008
sub-technique of T1059 Command and Scripting Interpreter
- Tactic
- Execution
- Platform
- Network Devices
- Version
- 1.2
- Created
- 20 October 2020
- Last modified
- 12 May 2026
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads. The CLI is the primary means through which users and administrators interact with the device in order to view system information, modify device operations, or perform diagnostic and administrative functions. CLIs typically contain various permission levels required for different commands.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.2
CampaignsTop 17%
Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.3
Tools & malware57th pct
Tools & malware57th percentile · 57% of ATT&CK techniques have this many tools implementing them or fewer.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Network Device CLI MITRE reference T1059.008
Top 17%of all ATT&CK techniques for number of campaigns
2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
RedPenguinC0056 ↗
During RedPenguin, UNC3886 accessed the Junos OS CLI on targeted devices.12
All 2 campaigns for this technique
3 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
PHASEJAMS9014 ↗
Has leveraged native commands associated with the compromised network appliance to execute code.1
DRYHOOKS9013 ↗
Has the ability to interact with Ivanti Connect Secure environments and to modify system components.12
Line DancerS1186 ↗
Can execute native commands in networking device command line interfaces.12
All 3 software entries for this technique
Offense vs defense T1059.008
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Network Device CLI detection strategy DET0142
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Behavioral Detection of CLI Abuse on Network Devices
1 platform
AN0399 · Network Devices
Detects unauthorized or anomalous use of command-line interfaces (CLI) on network devices. Focuses on remote access sessions (e.g., SSH/Telnet), privilege escalation within CLI sessions, execution of high-risk commands (e.g., config replace, terminal monitor, no logging), and configuration changes outside of approved windows.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | networkdevice:syslog | authorization/accounting logs |
| Command ExecutionDC0064 | networkdevice:syslog | command_exec |
| Network Traffic ContentDC0085 | NSM:Flow | remote CLI session detection |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Config changes made outside of maintenance windows are more suspicious. |
| UserContext | Unexpected CLI activity by service accounts or users not assigned to manage network devices. |
| CommandPattern | Regex or keyword match on dangerous or unusual commands (e.g., 'no logging', 'reload', 'copy tftp', 'config replace'). |
| SourceIP | Remote CLI sessions originating from untrusted networks or jump hosts. |
| SessionDuration | Abnormally short or long SSH/Telnet CLI sessions compared to baseline. |
Execution PreventionM1038
TACACS+ can keep control over which commands administrators are permitted to use through the configuration of authentication and command authorization.
Use of Authentication, Authorization, and Accounting (AAA) systems will limit actions administrators can perform and provide a history of user actions to detect unauthorized use and abuse. TACACS+ can keep control over which commands administrators are permitted to use through the configuration of authentication and command authorization
Use of Authentication, Authorization, and Accounting (AAA) systems will limit actions users can perform and provide a history of user actions to detect unauthorized use and abuse. Ensure least privilege principles are applied to user accounts and groups so that only authorized users can perform configuration changes.