Cross-source coverage
T1546.005 / ATT&CK
Event Triggered Execution: Trap
4 rules across 2 sources.
From MITRE ATT&CK 19.2
Adversaries may establish persistence by executing malicious content triggered by an interrupt signal. The trap command allows programs and shells to specify commands that will be executed upon receiving interrupt signals. A common situation is a script allowing for graceful termination and handling of common keyboard interrupts like ctrl+c and ctrl+d.
Adversaries can use this to register code to be executed when the shell encounters specific interrupts as a persistence mechanism. Trap commands are of the following format trap 'command list' signals where "command list" will be executed when "signals" are received.
- Tactics
- Privilege Escalation · Persistence
- Platforms
- macOS · Linux
- Telemetry
-
auditd:SYSCALLmacos:unifiedlog
How MITRE says to detect it DET0369
Detection Strategy for Event Triggered Execution via Trap (T1546.005)
Linux Analytic 1038
Correlate file modifications in shell startup scripts (e.g.,.bashrc,.profile) with embedded `trap` commands and observe if those changes are followed by the unexpected execution of child processes when terminal signals (e.g., SIGINT) are triggered. Use contextual linking with user session activity to detect privilege misuse.
auditd:SYSCALLexecveauditd:SYSCALLModification of user shell profile or trap registration via echo/redirection (e.g., echo "trap 'malicious_cmd' INT" >> ~/.bashrc)auditd:SYSCALLopen
macOS Analytic 1039
Detect unauthorized `trap` command registrations in shell startup files (e.g.,.zprofile,.bash_profile,.zshrc) followed by execution chains during user terminal interaction. Use Unified Logs and EDR telemetry to correlate shell command parsing and process tree anomalies.
macos:unifiedlogCommand line containing `trap` or `echo 'trap` written to login shell filesmacos:unifiedlogFile write or append to .zshrc, .bash_profile, .zprofile, etc.
socfortress/Wazuh-Rules
3 rules| Detection | Severity | Format |
|---|---|---|
| Generic detection of bash trap command with signal and script (T1546.005) | High | Wazuh XML |
| Potential persistence via bash trap on SIGINT (CTRL+C) (T1546.005) | High | Wazuh XML |
| Potential persistence via bash trap on EXIT signal (T1546.005) | Medium | Wazuh XML |
elastic/detection-rules
1 rule| Detection | Severity | Format |
|---|---|---|
| Trap Signals Execution | Low | Elastic TOML |