Event Triggered Execution: Unix Shell Configuration Modification T1546.004

Tactics: Privilege Escalation, Persistence

Adversaries may establish persistence through executing malicious commands triggered by a user’s shell. User Unix Shells execute several configuration scripts at different points throughout the session based on events. For example, when a user opens a command-line interface or remotely logs in (such as via SSH) a login shell is initiated. The login shell executes scripts from the system (/etc) and the user’s home directory (~/) to configure the environment. All login shells on a system use /etc/profile when initiated. These configuration scripts run at the permission level of their directory and are often used to set environment variables, create aliases, and customize the user’s environment. When the shell exits or terminates, additional shell scripts are executed to ensure the shell exits appropriately.

Events covered

5 catalog events are tagged with this technique by at least one rule.

Authoring guide

These 17 rules share fields, values, and exclusions.

Fields filtered most (24 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
EventType12eq 8, in 4exec, creation, ProcessRollup2, connection_attempted, exec_event
event.type10eq 9, ne 1start, change, deletion
host.os.type8eq 7, in 1
process_name8in 5, eq 2, is_not_null 1, starts_with 1, wildcard 1bash, csh, dash, *.elf, *.lua*
TargetFilename6wildcard 4, starts_with 2, contains 1/boot/efi/efi/*/grub.cfg, /boot/grub/grub.cfg, /boot/grub2/grub.cfg, /dev/shm/.*.swp, /etc/*
process.args5in 4, eq 2, contains 1, starts_with 1, wildcard 1* /dev/shm/* , * /home/*, * /run/*, --, --command
parent_process_name4eq 4, in 1, starts_with 1, wildcard 1login, *.bin, *.lua, *.pl, sshd
process.args_count4eq 41, 2
CommandLine3wildcard 2, contains 1, in 1* nc *, * nc.traditional *, * ncat *, * profile*, * setsid *
Image3starts_with 2, wildcard 1./, /boot/, /boot/*, /dev/shm/, /dev/shm/*
ParentImage2eq 1, wildcard 1., /dev/shm/*, /etc/profile.d/*, /usr/sbin/sshd
container.id2starts_with 2?
event.category2eq 2file, process
file.extension2eq 1, in 1service, swp, timer
file.name2in 2.bash_aliases, .bash_login, .bash_logout, .bash_profile, .bashrc

Top indicator values (618 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
event.typeeq
start
81087
EventTypeeq
exec
6579
process_namein
bash
4202
process_namein
sh
4197
process_namein
zsh
4196
process_namein
csh
3159
process_namein
dash
3170
process_namein
fish
3163
process_namein
ksh
3163
process_namein
tcsh
3156
process.args_counteq
1
350
CommandLinewildcard
*disown*
210
CommandLinewildcard
*xxd *
212
EventTypein
creation
234
EventTypein
exec
2206
TargetFilenamewildcard
/etc/bash.bashrc
22
TargetFilenamewildcard
/etc/cron.allow
23
TargetFilenamewildcard
/etc/cron.d/*
23
TargetFilenamewildcard
/etc/cron.daily/*
23
TargetFilenamewildcard
/etc/cron.deny
23
TargetFilenamewildcard
/etc/cron.hourly/*
23
TargetFilenamewildcard
/etc/cron.monthly/*
23
TargetFilenamewildcard
/etc/cron.weekly/*
23
TargetFilenamewildcard
/etc/crontab
23
TargetFilenamewildcard
/etc/csh.cshrc
22
TargetFilenamewildcard
/etc/csh.login
22
TargetFilenamewildcard
/etc/fish/config.fish
22
TargetFilenamewildcard
/etc/ksh.kshrc
22
TargetFilenamewildcard
/etc/profile
22
TargetFilenamewildcard
/etc/profile.d/*
22

Exclusions (364 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
Imagein
/bin/yum
2
Imagein
/usr/bin/yum
2
ParentImagewildcard
/tmp/newroot/*
2
dest_ipcidr_match
10.0.0.0/8
2
dest_ipcidr_match
100.64.0.0/10
2
dest_ipcidr_match
127.0.0.0/8
2
dest_ipcidr_match
169.254.0.0/16
2
dest_ipcidr_match
172.16.0.0/12
2
dest_ipcidr_match
192.0.0.0/24
2
dest_ipcidr_match
192.0.2.0/24
2
dest_ipcidr_match
192.168.0.0/16
2
dest_ipcidr_match
192.175.48.0/24
2
dest_ipcidr_match
192.31.196.0/24
2
dest_ipcidr_match
192.52.193.0/24
2
dest_ipcidr_match
192.88.99.0/24
2

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Sigma 1 rule

Elastic 13 rules

Splunk 3 rules