Detection rules › Sigma
Unix Shell Configuration Modification
Detect unix shell configuration modification. Adversaries may establish persistence through executing malicious commands triggered when a new shell is opened.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1546.004 Event Triggered Execution: Unix Shell Configuration Modification |
| Privilege Escalation | T1546.004 Event Triggered Execution: Unix Shell Configuration Modification |
Event coverage
| Provider | Event |
|---|---|
| Linux-Auditd | Event ID 1302 |
Rule body yaml
title: Unix Shell Configuration Modification
id: a94cdd87-6c54-4678-a6cc-2814ffe5a13d
related:
- id: e74e15cc-c4b6-4c80-b7eb-dfe49feb7fe9
type: obsolete
status: test
description: Detect unix shell configuration modification. Adversaries may establish persistence through executing malicious commands triggered when a new shell is opened.
references:
- https://objective-see.org/blog/blog_0x68.html
- https://web.archive.org/web/20221204161143/https://www.glitch-cat.com/p/green-lambert-and-attack
- https://www.anomali.com/blog/pulling-linux-rabbit-rabbot-malware-out-of-a-hat
author: Peter Matkovski, IAI
date: 2023-03-06
modified: 2023-03-15
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1546.004
logsource:
product: linux
service: auditd
detection:
selection:
type: 'PATH'
name:
- '/etc/shells'
- '/etc/profile'
- '/etc/profile.d/*'
- '/etc/bash.bashrc'
- '/etc/bashrc'
- '/etc/zsh/zprofile'
- '/etc/zsh/zshrc'
- '/etc/zsh/zlogin'
- '/etc/zsh/zlogout'
- '/etc/csh.cshrc'
- '/etc/csh.login'
- '/root/.bashrc'
- '/root/.bash_profile'
- '/root/.profile'
- '/root/.zshrc'
- '/root/.zprofile'
- '/home/*/.bashrc'
- '/home/*/.zshrc'
- '/home/*/.bash_profile'
- '/home/*/.zprofile'
- '/home/*/.profile'
- '/home/*/.bash_login'
- '/home/*/.bash_logout'
- '/home/*/.zlogin'
- '/home/*/.zlogout'
condition: selection
falsepositives:
- Admin or User activity are expected to generate some false positives
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
type: 'PATH'
name:
- '/etc/shells'
- '/etc/profile'
- '/etc/profile.d/*'
- '/etc/bash.bashrc'
- '/etc/bashrc'
- '/etc/zsh/zprofile'
- '/etc/zsh/zshrc'
- '/etc/zsh/zlogin'
- '/etc/zsh/zlogout'
- '/etc/csh.cshrc'
- '/etc/csh.login'
- '/root/.bashrc'
- '/root/.bash_profile'
- '/root/.profile'
- '/root/.zshrc'
- '/root/.zprofile'
- '/home/*/.bashrc'
- '/home/*/.zshrc'
- '/home/*/.bash_profile'
- '/home/*/.zprofile'
- '/home/*/.profile'
- '/home/*/.bash_login'
- '/home/*/.bash_logout'
- '/home/*/.zlogin'
- '/home/*/.zlogout'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
name | eq |
|
type | eq |
|