AN1038
Analytic 1038
Linux
Correlate file modifications in shell startup scripts (e.g., .bashrc, .profile) with embedded `trap` commands and observe if those changes are followed by the unexpected execution of child processes when terminal signals (e.g., SIGINT) are triggered. Use contextual linking with user session activity to detect privilege misuse.
auditd:SYSCALL
execve
auditd:SYSCALL
Modification of user shell profile or trap registration via echo/redirection (e.g., echo "trap 'malicious_cmd' INT" >> ~/.bashrc)
auditd:SYSCALL
open
[TargetShellFilePath]
The path to user profile scripts (e.g., ~/.bashrc, ~/.zshrc); may differ by distro or shell type.
[SignalTrapName]
Trap signal (e.g., INT, HUP, TERM) can be environment-specific or attacker-tuned to evade.
[TimeWindow]
Temporal threshold to correlate trap insertion and process execution (e.g., 10s-5min)
AN1039
Analytic 1039
macOS
Detect unauthorized `trap` command registrations in shell startup files (e.g., .zprofile, .bash_profile, .zshrc) followed by execution chains during user terminal interaction. Use Unified Logs and EDR telemetry to correlate shell command parsing and process tree anomalies.
macos:unifiedlog
Command line containing `trap` or `echo 'trap` written to login shell files
macos:unifiedlog
File write or append to .zshrc, .bash_profile, .zprofile, etc.
[LoginShellConfigPaths]
Startup files vary by shell (.bash_profile, .zshrc, etc.)
[TrapCommandLengthThreshold]
Short benign traps may differ from longer/multi-command malicious traps
[ParentProcessAnomalyThreshold]
Score or detect if new child process deviates from shell’s typical behavior