Finding '/bin/sh' in command output captured by an IDS most likely suggests which of the following?

• A. Normal system maintenance activity
• B. A DNS misconfiguration
• C. A benign script execution
• D. An attempt to launch a command-line shell or remote command execution

Answer: (D)

When an IDS captures command output that shows the shell executable path, it points to someone starting a command-line interpreter to run subsequent commands. /bin/sh is the standard shell on many Unix-like systems, so seeing it in the output suggests a shell process was launched. That’s how attackers gain remote or local command execution: they spawn a shell to issue commands, explore the system, or backdoor in a foothold. In this context, it’s a strong indicator of an attempt to launch a command-line shell or execute commands remotely. Normal maintenance or benign scripts wouldn’t typically appear as an unexpected shell invocation in IDS output, and DNS misconfigurations don’t involve spawning a shell.