From Shell Commands to ATT&CK: Building Genos, an Open-Source Command Intelligence Engine

No ratings

Presented at BSides Toronto 2026 by

Ahmed Khan

Command-line activity is one of the clearest places where attacker behavior shows up, but interpreting it correctly is not always simple. A single command can be obviously malicious, completely benign, or only suspicious depending on context. This talk goes over the design and development of Genos, an open-source command intelligence engine that classifies shell commands as benign, malicious, or context-dependent, while also mapping malicious behavior to MITRE ATT&CK techniques. We will look at why command-line detection is difficult, how attackers use obfuscation and living-off-the-land binaries, and how Genos combines de-obfuscation, machine learning, and rule-based security logic to make real-time decisions. The talk will also cover lessons learned from building the system, including dataset problems, false positives, technique-mapping challenges, and the gap between a research prototype and something defenders can actually use.