Detect Shebang Code Inside Device Files
Query
DeviceFileEvents
| extend AF=parse_json(AdditionalFields) | where tostring(AF.FileType) == "Shebang"
| where FolderPath has_any ("\\Downloads\\", "\\AppData\\Local\\Temp\\", "/tmp/", "/var/tmp/", "/Users/Shared/", "/Downloads/")
| project Timestamp, DeviceName,DeviceId, ActionType, FileName, FolderPath, SHA256, InitiatingProcessFileName,
InitiatingProcessCommandLine,ReportIdAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1059.004 | Command and Scripting Interpreter: Unix Shell |
Author: Sergio Albea (11/06/2026)
DDetect Shebang code inside Device Files
Description: Shebangs (#!) are native to Unix-like operating systems (macOS and Linux). Standard Windows consoles (Command Prompt and PowerShell) do not natively use them. However, they do work on Windows when using tools such as the Python Launcher, Git Bash, Cygwin, or Unix-like environments such as WSL. In simple terms, a Shebang tells the operating system which interpreter should execute a script. For example: #!/usr/bin/python3
For this query, I would recommend performing some threat hunting first and creating a whitelist for known false positives or trusted devices (for example, devices managed by developers). Once the detection is properly tuned, it can be a good way to monitor the download or import of Shebang files on suspicious directories, making it a strong candidate for a threat detection rule.
Explanation
This KQL (Kusto Query Language) query is designed to detect the presence of Shebang code in files on devices, specifically focusing on files located in certain directories that are often used for temporary storage or downloads. Here's a simple breakdown of what the query does:
-
Targeted Files: It looks for files that have a Shebang (#!) at the beginning, which indicates that the file is a script and specifies which interpreter should run it. This is common in Unix-like systems but can also be found on Windows under certain conditions.
-
Directories of Interest: The query specifically checks for these files in directories that are commonly used for downloads or temporary storage:
\\Downloads\\\\AppData\\Local\\Temp\\/tmp//var/tmp//Users/Shared//Downloads/
-
Filtering and Output: It filters the events to only include those where the file type is identified as "Shebang" and the file is located in one of the specified directories. The query then outputs relevant details about these files, such as:
- Timestamp of the event
- Device name and ID
- Action type (what was done with the file)
- File name and path
- SHA256 hash of the file
- Information about the process that initiated the file event
-
Purpose: The goal is to help in threat detection by identifying potentially suspicious script files that are downloaded or stored in these directories. Before using this as a detection rule, it's recommended to perform threat hunting and create a whitelist for known false positives or trusted devices to reduce noise.
In summary, this query is a tool for monitoring and detecting potentially malicious script files in specific directories, aiding in the identification of suspicious activities on a network.
