Techniques › T1546.005 › AN1038
AN1038 Analytic 1038
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Correlate file modifications in shell startup scripts (e.g., .bashrc, .profile) with embedded
trap commands and observe if those changes are followed by the unexpected execution of child processes when terminal signals (e.g., SIGINT) are triggered. Use contextual linking with user session activity to detect privilege misuse.</p>- Detects
- T1546.005 Trap
- Part of
- DET0369 Detection Strategy for Event Triggered Execution via Trap (T1546.005)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | execve | DC0032 Process Creation |
| auditd:SYSCALL | Modification of user shell profile or trap registration via echo/redirection (e.g., echo "trap 'malicious_cmd' INT" >> ~/.bashrc) | DC0061 File Modification |
| auditd:SYSCALL | open | DC0055 File Access |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TargetShellFilePath | The path to user profile scripts (e.g., ~/.bashrc, ~/.zshrc); may differ by distro or shell type. |
SignalTrapName | Trap signal (e.g., INT, HUP, TERM) can be environment-specific or attacker-tuned to evade. |
TimeWindow | Temporal threshold to correlate trap insertion and process execution (e.g., 10s-5min) |