Techniques › T1546.005 › AN1039
AN1039 Analytic 1039
macOS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detect unauthorized
trap command registrations in shell startup files (e.g., .zprofile, .bash_profile, .zshrc) followed by execution chains during user terminal interaction. Use Unified Logs and EDR telemetry to correlate shell command parsing and process tree anomalies.</p>- Detects
- T1546.005 Trap
- Part of
- DET0369 Detection Strategy for Event Triggered Execution via Trap (T1546.005)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| macos:unifiedlog | Command line containing `trap` or `echo 'trap` written to login shell files | DC0032 Process Creation |
| macos:unifiedlog | File write or append to .zshrc, .bash_profile, .zprofile, etc. | DC0061 File Modification |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
LoginShellConfigPaths | Startup files vary by shell (.bash_profile, .zshrc, etc.) |
TrapCommandLengthThreshold | Short benign traps may differ from longer/multi-command malicious traps |
ParentProcessAnomalyThreshold | Score or detect if new child process deviates from shell’s typical behavior |