- Tactics
- Privilege Escalation, Persistence
- Platforms
- macOS, Linux
- Reference
- attack.mitre.org/techniques/T1546.005
Description
Adversaries may establish persistence by executing malicious content triggered by an interrupt signal. The trap command allows programs and shells to specify commands that will be executed upon receiving interrupt signals. A common situation is a script allowing for graceful termination and handling of common keyboard interrupts like ctrl+c and ctrl+d.
Adversaries can use this to register code to be executed when the shell encounters specific interrupts as a persistence mechanism. Trap commands are of the following format trap ‘command list’ signals where “command list” will be executed when “signals” are received.(Citation: Trap Manual)(Citation: Cyberciti Trap Statements)
How GTK Cyber trains on this
GTK Cyber's Threat Hunting with Data Science course teaches you to build machine-learning detections for techniques like this across the MITRE ATT&CK framework, including the Privilege Escalation, Persistence tactic this technique falls under. Practitioner-led, focused on real detections, not memorizing technique IDs.
Related techniques
- T1037 - Boot or Logon Initialization Scripts
- T1053 - Scheduled Task/Job
- T1055 - Process Injection
- T1068 - Exploitation for Privilege Escalation
- T1078 - Valid Accounts
- T1098 - Account Manipulation
- T1112 - Modify Registry
- T1133 - External Remote Services
- T1134 - Access Token Manipulation
- T1136 - Create Account
- T1137 - Office Application Startup
- T1176 - Software Extensions