Shell Eval and Variable Obfuscation

How the attack works

An attacker or a compromised agent constructs a command string that isn't a plain, readable command. Instead it uses eval with interpolated variables, backtick or nested subshell substitution, or encodes the payload as hex/octal bytes that get piped through printf into a shell. This obscures the actual command from any tool or reviewer scanning for known-bad strings, letting the real payload execute only when the shell processes the obfuscation layer.

Netzilo detection

Why it matters

An organization loses visibility into what an AI agent or script is actually executing, which lets malicious commands bypass string-based detection and blend into normal shell activity, delaying detection of compromise or data exfiltration.

What you can do

• →Restrict AI agents' shell access to an allowlist of specific commands rather than arbitrary shell execution.
• →Review any agent-generated shell commands that use eval, backticks, or printf-to-shell piping before allowing execution.
• →Log shell commands after variable expansion, not just the literal string sent, so obfuscated payloads are visible.
• →Treat hex/octal-encoded command construction as a strong signal for manual review, since it's rarely needed for legitimate tasks.

Known benign look-alikes

• Shell scripts that use backtick substitution for command output capture in legacy code
• Build scripts that use eval for dynamic variable assignment in configuration generation

References

• https://attack.mitre.org/techniques/T1027/
• https://attack.mitre.org/techniques/T1059/
• https://arxiv.org/abs/2403.04783

Related threats