Event Triggered Execution: Trap `T1546.005`

Tactics: Privilege Escalation, Persistence

Adversaries may establish persistence by executing malicious content triggered by an interrupt signal. The trap command allows programs and shells to specify commands that will be executed upon receiving interrupt signals. A common situation is a script allowing for graceful termination and handling of common keyboard interrupts like ctrl+c and ctrl+d.

Events covered

1 catalog event is tagged with this technique by at least one rule.

Provider	Event	Title
ESF	exec	Process Execution

Authoring guide

These 1 rule share fields, values, and exclusions.

Fields filtered most (4 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EventType`	1	`in` 1	`exec`, `exec_event`, `executed`
`event.type`	1	`eq` 1	`start`
`process.args`	1	`starts_with` 1	`SIG`
`process_name`	1	`eq` 1	`trap`

Top indicator values (7 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`EventType`	`in`	`exec` elasticTrap Signals Execution	1	206
`EventType`	`in`	`exec_event` elasticTrap Signals Execution	1	150
`EventType`	`in`	`executed` elasticTrap Signals Execution	1	98
`EventType`	`in`	`process_started` elasticTrap Signals Execution	1	83
`event.type`	`eq`	`start` elasticTrap Signals Execution	1	1087
`process.args`	`starts_with`	`SIG` elasticTrap Signals Execution	1
`process_name`	`eq`	`trap` elasticTrap Signals Execution	1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: macOS

Domain: Endpoint

Elastic 1 rule

Trap Signals Execution