Does blocking one observed shell command line stop ATT&CK T1059.004 on a CI runner?

## The claim under examination *We blocked that command line, so that technique is handled.* It is the single most common wrong answer a competent engineer gives about ATT&CK, and it comes from treating the numbered level and the unnumbered level as the same kind of thing. ## What you actually removed A procedure is a **matchable value**: the literal text, its argument order, the parent that launched it. Blocking it is a real control with a real effect — on that value. A technique is a **class of behaviour**, and `T1059.004` Unix Shell is the class *an adversary uses a Unix command shell to execute commands*. The class is defined by what the action depends on, not by how it was typed. So the question is never *did we block what we saw?* but *what does the class require that we have taken away?* Blocking a string takes away nothing the class requires. ## Why respelling is free here specifically The position matters. The operator in this scenario already holds standing privilege on a self-hosted CI runner: they can define or edit a job step, and the runner spawns processes for them by design. From that position the same action can be respelled without acquiring anything new: - start the shell from a small script committed alongside the job instead of inline; - reorder or rename the arguments; - read the commands from an environment variable the runner already exports; - have a different parent — a build helper, a test harness — start the same interpreter; - feed the commands over standard input rather than as arguments. Each one is a different value. Every one is `T1059.004`. ## The economics, which is the part interviewers push on Say the operator is a ransomware affiliate working on a revenue split. They are paid for the intrusion and its outcome; nobody pays them per command line. The replacement cost of a procedure is measured in minutes of their afternoon and zero dollars. A control priced against that cost is a control you should describe as *friction*, and friction has a shelf life. Contrast what the class cannot substitute. `T1059.004` needs two things at once: a shell interpreter that is present and executable in that job context, and something able to hand it operator-supplied input. Take either away and the class goes with it — and both are expensive to the business, which is precisely why they are decisions rather than fixes. That asymmetry is the whole lesson: the cheap control is cheap for the adversary to route around, and the expensive control is the one that changes their cost. ## What the block does buy, so you are not dismissive Not nothing: - automated payloads and off-the-shelf scripts that hard-code the exact invocation stop working; - an operator who is following someone else's playbook and cannot improvise is genuinely stopped; - reuse of that value elsewhere in the estate is closed off at the same time. So ship it — but ship it as an interim, and say so. What you must not do is let it close out an item written at the technique level, because the two are not the same size. ## Saying it cleanly *We removed one procedure. The technique is `T1059.004`, and the operator holds standing privilege on the runner, so respelling costs them minutes. The technique goes away when the shell is not reachable in that job context, or when the job cannot start a process from input the operator controls — and both of those are business decisions, not a control we can turn on this afternoon.*