Cross-source coverage
T1546.004 / ATT&CK
Event Triggered Execution: Unix Shell Configuration Modification
19 rules across 5 sources.
From MITRE ATT&CK 19.2
Adversaries may establish persistence through executing malicious commands triggered by a user’s shell. User Unix Shells execute several configuration scripts at different points throughout the session based on events. For example, when a user opens a command-line interface or remotely logs in (such as via SSH) a login shell is initiated. The login shell executes scripts from the system (/etc) and the user’s home directory (~/) to configure the environment. All login shells on a system use /etc/profile when initiated. These configuration scripts run at the permission level of their directory and are often used to set environment variables, create aliases, and customize the user’s environment. When the shell exits or terminates, additional shell scripts are executed to ensure the shell exits appropriately.
Adversaries may attempt to establish persistence by inserting commands into scripts automatically executed by shells. Using bash as an example, the default shell for most GNU/Linux systems, adversaries may add commands that launch malicious binaries into the /etc/profile and /etc/profile.d files. These files typically require root permissions to modify and are executed each time any shell on a system launches. For user level permissions, adversaries can insert malicious commands into ~/.bash_profile, ~/.bash_login, or ~/.profile which are sourced when a user opens a command-line interface or connects remotely. Since the system only executes the first existing file in the listed order, adversaries have used ~/.bash_profile to ensure execution. Adversaries have also leveraged the ~/.bashrc file which is additionally executed if the connection is established remotely or an additional interactive shell is opened, such as a new tab in the command-line interface. Some malware targets the termination of a program to trigger execution, adversaries can use the ~/.bash_logout file to execute malicious commands at the end of a session.
For macOS, the functionality of this technique is similar but may leverage zsh, the default shell for macOS 10.15+. When the Terminal.app is opened, the application launches a zsh login shell and a zsh interactive shell. The login shell configures the system environment using /etc/profile, /etc/zshenv, /etc/zprofile, and /etc/zlogin. The login shell then configures the user environment with ~/.zprofile and ~/.zlogin. The interactive shell uses the ~/.zshrc to configure the user environment. Upon exiting, /etc/zlogout and ~/.zlogout are executed. For legacy programs, macOS executes /etc/bashrc on startup.
- Tactics
- Privilege Escalation · Persistence
- Platforms
- Linux · macOS
- Telemetry
-
auditd:SYSCALLauditd:EXECVENSM:Flowmacos:unifiedlogmacos:endpointsecurity
How MITRE says to detect it DET0020
Detect Shell Configuration Modification for Persistence via Event-Triggered Execution
Linux Analytic 0059
Detects modification of shell startup/logout scripts such as ~/.bashrc, ~/.bash_profile, or /etc/profile, followed by anomalous process execution or network connections upon interactive or remote shell login.
auditd:SYSCALLAUDIT_SYSCALL (open, write, rename, unlink)auditd:EXECVEexecution of unexpected binaries during user shell startupNSM:Flowunexpected network activity initiated shortly after shell session starts
macOS Analytic 0060
Correlates zsh shell configuration file changes (e.g., ~/.zshrc, ~/.zlogin, /etc/zprofile) with execution of unauthorized binaries or unexpected network activity triggered on Terminal.app launch.
macos:unifiedloglaunch of Terminal.app or shell with non-standard environment setupmacos:endpointsecurityES_EVENT_TYPE_NOTIFY_WRITE, targeting .zshrc, .zlogin, .zprofile
elastic/detection-rules
10 rules| Detection | Severity | Format |
|---|---|---|
| Curl Execution via Shell Profile | High | Elastic TOML |
| Suspicious Echo or Printf Execution Detected via Defend for Containers | High | Elastic TOML |
| Bash Shell Profile Modification | Medium | Elastic TOML |
| Network Connection Initiated by Suspicious SSHD Child Process | Medium | Elastic TOML |
| Pod or Container Creation with Suspicious Command-Line | Medium | Elastic TOML |
| Shell Configuration Creation | Medium | Elastic TOML |
| Modification of Persistence Relevant Files Detected via Defend for Containers | Low | Elastic TOML |
| Potential Persistence via File Modification | Low | Elastic TOML |
| Potential Suspicious File Edit | Low | Elastic TOML |
| Unusual SSHD Child Process | Low | Elastic TOML |
elastic/protections-artifacts
3 rules| Detection | Severity | Format |
|---|---|---|
| Binary Execution from Unusual Location through Shell Profile | Undefined | Elastic TOML |
| Suspicious Echo Execution | Undefined | Elastic TOML |
| Unsigned or Untrusted Binary Execution via Zshrc | Undefined | Elastic TOML |
splunk/security_content
3 rules| Detection | Severity | Format |
|---|---|---|
| Linux Auditd Unix Shell Configuration Modification | Undefined | SPL |
| Linux File Creation In Profile Directory | Undefined | SPL |
| Linux Possible Append Command To Profile Config File | Undefined | SPL |
falcosecurity/rules
2 rules| Detection | Severity | Format |
|---|---|---|
| Modify Shell Configuration File | Medium | Falco YAML |
| Read Shell Configuration File | Medium | Falco YAML |
SigmaHQ/sigma
1 rule| Detection | Severity | Format |
|---|---|---|
| Unix Shell Configuration Modification | Medium | Sigma |