Event Triggered Execution: Unix Shell Configuration Modification T1546.004
Tactics: Privilege Escalation, Persistence
Adversaries may establish persistence through executing malicious commands triggered by a user’s shell. User Unix Shells execute several configuration scripts at different points throughout the session based on events. For example, when a user opens a command-line interface or remotely logs in (such as via SSH) a login shell is initiated. The login shell executes scripts from the system (/etc) and the user’s home directory (~/) to configure the environment. All login shells on a system use /etc/profile when initiated. These configuration scripts run at the permission level of their directory and are often used to set environment variables, create aliases, and customize the user’s environment. When the shell exits or terminates, additional shell scripts are executed to ensure the shell exits appropriately.
Events covered
5 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| ESF | exec | Process Execution |
| Linux-Auditd | Event ID 1302 | PATH |
| Linux-Auditd | Event ID 1307 | CWD |
| Sysmon-for-Linux | Event ID 1 | Process Create |
| Sysmon-for-Linux | Event ID 11 | File created |
Authoring guide
These 17 rules share fields, values, and exclusions.
Fields filtered most (24 distinct)
These fields appear most often in rule filters.
Top indicator values (618 distinct)
These values appear most often in rule predicates.
Exclusions (364 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Sigma 1 rule
Elastic 13 rules
- Bash Shell Profile Modification
- Binary Execution from Unusual Location through Shell Profile
- Curl Execution via Shell Profile
- Modification of Persistence Relevant Files Detected via Defend for Containers
- Network Connection Initiated by Suspicious SSHD Child Process
- Pod or Container Creation with Suspicious Command-Line
- Potential Persistence via File Modification
- Potential Suspicious File Edit
- Shell Configuration Creation
- Suspicious Echo Execution
- Suspicious Echo or Printf Execution Detected via Defend for Containers
- Unsigned or Untrusted Binary Execution via Zshrc
- Unusual SSHD Child Process