Shell startup or logout script modified on Linux

Siemphony@siemphonylowT1546.004unverifiedPlaybook · Persistence established

Matches the file-modification leg of AN0059: an auditd PATH record naming one of the configuration scripts a login or interactive shell sources on its own, which is where this technique plants the command it wants re-executed at every logon. The path list is MITRE's `FilePathRegex` knob, populated here with the bash, sh and zsh per-user dotfiles plus their system-wide counterparts under /etc, and it is anchored on the filename rather than on an absolute path because auditd records `name=` exactly as it was handed to the syscall, so an editor run from inside the home directory logs a bare `.bashrc`. Three limits are structural. auditd emits PATH and SYSCALL as separate records for one event, and the writing process's `exe`, `uid` and `auid` live only on the SYSCALL side, so MITRE's `TargetUser` knob cannot be applied inside this selection at all; the analytic's second half — an unexpected binary executing shortly after shell startup, within MITRE's `TimeWindow` knob — is a cross-event correlation lib/sigma has no way to express; and the macOS arm AN0060 is not attempted, because its unifiedlog and EndpointSecurity sources have no standardised Sigma field names and inventing them would produce a rule that parses everywhere and matches nothing. Prerequisite: auditd watches none of these paths by default, so this rule returns zero rows until watches such as `-w /etc/profile -p wa` and a per-home `-w /home/<user>/.bashrc -p wa` are loaded, and zero rows reads as quiet when it actually means blind. The `wa` permission also matters for noise: with it, only writes and attribute changes are recorded, whereas a watch including `r` makes every shell login match. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0020, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 3 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Shell startup or logout script modified on Linux2id: a01eef05-d4a9-4665-b1fb-7f7d1dcc10bd3status: experimental4description: |5  Matches the file-modification leg of AN0059: an auditd PATH record naming one6  of the configuration scripts a login or interactive shell sources on its own,7  which is where this technique plants the command it wants re-executed at every8  logon. The path list is MITRE's `FilePathRegex` knob, populated here with the9  bash, sh and zsh per-user dotfiles plus their system-wide counterparts under10  /etc, and it is anchored on the filename rather than on an absolute path11  because auditd records `name=` exactly as it was handed to the syscall, so an12  editor run from inside the home directory logs a bare `.bashrc`. Three limits13  are structural. auditd emits PATH and SYSCALL as separate records for one14  event, and the writing process's `exe`, `uid` and `auid` live only on the15  SYSCALL side, so MITRE's `TargetUser` knob cannot be applied inside this16  selection at all; the analytic's second half — an unexpected binary executing17  shortly after shell startup, within MITRE's `TimeWindow` knob — is a18  cross-event correlation lib/sigma has no way to express; and the macOS arm19  AN0060 is not attempted, because its unifiedlog and EndpointSecurity sources20  have no standardised Sigma field names and inventing them would produce a rule21  that parses everywhere and matches nothing. Prerequisite: auditd watches none22  of these paths by default, so this rule returns zero rows until watches such23  as `-w /etc/profile -p wa` and a per-home `-w /home/<user>/.bashrc -p wa` are24  loaded, and zero rows reads as quiet when it actually means blind. The `wa`25  permission also matters for noise: with it, only writes and attribute changes26  are recorded, whereas a watch including `r` makes every shell login match.27  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0020, not hand-written and not tested by its author. Any lab result is on this rule's own page.28references:29  - https://attack.mitre.org/techniques/T1546/00430  - https://attack.mitre.org/detectionstrategies/DET002031author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)32date: 2026-08-1633tags:34  - attack.privilege-escalation35  - attack.persistence36  - attack.t1546.00437logsource:38  product: linux39  service: auditd40detection:41  selection_dotfiles:42    type: 'PATH'43    name|endswith:44      - '.bashrc'45      - '.bash_profile'46      - '.bash_login'47      - '.bash_logout'48      - '.bash_aliases'49      - '.profile'50      - '.zshrc'51      - '.zshenv'52      - '.zprofile'53      - '.zlogin'54      - '.zlogout'55      - '/etc/profile'56      - '/etc/bash.bashrc'57      - '/etc/bashrc'58      - '/etc/zsh/zshrc'59      - '/etc/zsh/zshenv'60      - '/etc/zsh/zprofile'61      - '/etc/zsh/zlogin'62      - '/etc/zsh/zlogout'63      - '/etc/zshrc'64      - '/etc/zshenv'65      - '/etc/zprofile'66      - '/etc/zlogin'67      - '/etc/zlogout'68  selection_profiled:69    type: 'PATH'70    name|contains: '/etc/profile.d/'71  condition: 1 of selection*72falsepositives:73  - "Configuration management and dotfile tooling rewriting the same files on a schedule: Ansible, Chef, Puppet and Salt pushing a standard ~/.bashrc or /etc/profile.d/ fragment to every host, and chezmoi, GNU stow, oh-my-zsh or a chef-managed home directory doing the same per user. On a managed estate this is the loudest match by a wide margin and is why the level is low rather than medium."74  - "Package installation and upgrade. Language runtimes and SDKs drop or replace files under /etc/profile.d/ from their postinst scripts, and the nvm, rvm, conda, pyenv and Rust installers all append their initialisation block to ~/.bashrc or ~/.zshrc as their documented final step."75  - "Account creation. useradd and adduser copy the /etc/skel dotfiles into each new home directory, so every provisioned user, service account and CI build user produces a burst of matching CREATE records."76  - "A user editing their own shell configuration in vim, nano or emacs to add an alias, a PATH entry or a prompt change. Editors write through a temporary file and rename it into place, so one interactive edit emits several PATH records for the same target."77  - "Backup, restore and home-directory migration jobs that unpack an archive over a user's home directory, recreating every dotfile in it."78level: low

Splunk · SPL

Run this as a search.

index=* ((type="PATH" AND (name="*.bashrc" OR name="*.bash_profile" OR name="*.bash_login" OR name="*.bash_logout" OR name="*.bash_aliases" OR name="*.profile" OR name="*.zshrc" OR name="*.zshenv" OR name="*.zprofile" OR name="*.zlogin" OR name="*.zlogout" OR name="*/etc/profile" OR name="*/etc/bash.bashrc" OR name="*/etc/bashrc" OR name="*/etc/zsh/zshrc" OR name="*/etc/zsh/zshenv" OR name="*/etc/zsh/zprofile" OR name="*/etc/zsh/zlogin" OR name="*/etc/zsh/zlogout" OR name="*/etc/zshrc" OR name="*/etc/zshenv" OR name="*/etc/zprofile" OR name="*/etc/zlogin" OR name="*/etc/zlogout")) OR (type="PATH" AND name="*/etc/profile.d/*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(type) == "path" AND (TO_LOWER(name) LIKE "*.bashrc" OR TO_LOWER(name) LIKE "*.bash_profile" OR TO_LOWER(name) LIKE "*.bash_login" OR TO_LOWER(name) LIKE "*.bash_logout" OR TO_LOWER(name) LIKE "*.bash_aliases" OR TO_LOWER(name) LIKE "*.profile" OR TO_LOWER(name) LIKE "*.zshrc" OR TO_LOWER(name) LIKE "*.zshenv" OR TO_LOWER(name) LIKE "*.zprofile" OR TO_LOWER(name) LIKE "*.zlogin" OR TO_LOWER(name) LIKE "*.zlogout" OR TO_LOWER(name) LIKE "*/etc/profile" OR TO_LOWER(name) LIKE "*/etc/bash.bashrc" OR TO_LOWER(name) LIKE "*/etc/bashrc" OR TO_LOWER(name) LIKE "*/etc/zsh/zshrc" OR TO_LOWER(name) LIKE "*/etc/zsh/zshenv" OR TO_LOWER(name) LIKE "*/etc/zsh/zprofile" OR TO_LOWER(name) LIKE "*/etc/zsh/zlogin" OR TO_LOWER(name) LIKE "*/etc/zsh/zlogout" OR TO_LOWER(name) LIKE "*/etc/zshrc" OR TO_LOWER(name) LIKE "*/etc/zshenv" OR TO_LOWER(name) LIKE "*/etc/zprofile" OR TO_LOWER(name) LIKE "*/etc/zlogin" OR TO_LOWER(name) LIKE "*/etc/zlogout")) OR (TO_LOWER(type) == "path" AND TO_LOWER(name) LIKE "*/etc/profile.d/*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="type" type="pcre2">(?i)^PATH$</field>    <field name="name" type="pcre2">(?i)(\.bashrc$|\.bash_profile$|\.bash_login$|\.bash_logout$|\.bash_aliases$|\.profile$|\.zshrc$|\.zshenv$|\.zprofile$|\.zlogin$|\.zlogout$|/etc/profile$|/etc/bash\.bashrc$|/etc/bashrc$|/etc/zsh/zshrc$|/etc/zsh/zshenv$|/etc/zsh/zprofile$|/etc/zsh/zlogin$|/etc/zsh/zlogout$|/etc/zshrc$|/etc/zshenv$|/etc/zprofile$|/etc/zlogin$|/etc/zlogout$)</field>    <description>Shell startup or logout script modified on Linux (1/2)</description>    <mitre>      <id>T1546.004</id>    </mitre>  </rule>   <rule id="100001" level="5">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="type" type="pcre2">(?i)^PATH$</field>    <field name="name" type="pcre2">(?i)/etc/profile\.d/</field>    <description>Shell startup or logout script modified on Linux (2/2)</description>    <mitre>      <id>T1546.004</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. No Sentinel table is modelled for this logsource ({"product":"linux","service":"auditd"}), so there is nothing honest to query. Pick a logsource this translator maps, or write the KQL by hand. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: auditd / linux
Level: low
Category: registry_persistence
Sigma status: experimental
Backends: 3 of 4 rendered
Updated: 30 Aug 2026
Rule ID: a01eef05-d4a9-4665-b1fb-7f7d1dcc10bd

ATT&CKT1546.004

T1546.004Unix Shell Configuration Modification

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 5 fired

Fires on none of the 5 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 5 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1546.004, evaluated against their — events.

Using it

Tuning & false positivesexperimental · 5 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Gate on nametype (CREATE/NORMAL) so write intent is stated inside the rule
Get the watches right first — they, not the path list, are the real surface.
Apply TargetUser by joining PATH to its SYSCALL sibling in the SIEM.
.profile is loose on purpose; AppArmor and firejail ship unrelated

Declared by the author

Configuration management and dotfile tooling rewriting the same files on a schedule: Ansible, Chef, Puppet and Salt pushing a standard ~/.bashrc or /etc/profile.d/ fragment to every host, and chezmoi, GNU stow, oh-my-zsh or a chef-managed home directory doing the same per user. On a managed estate this is the loudest match by a wide margin and is why the level is low rather than medium.
Package installation and upgrade. Language runtimes and SDKs drop or replace files under /etc/profile.d/ from their postinst scripts, and the nvm, rvm, conda, pyenv and Rust installers all append their initialisation block to ~/.bashrc or ~/.zshrc as their documented final step.
Account creation. useradd and adduser copy the /etc/skel dotfiles into each new home directory, so every provisioned user, service account and CI build user produces a burst of matching CREATE records.
A user editing their own shell configuration in vim, nano or emacs to add an alias, a PATH entry or a prompt change. Editors write through a temporary file and rename it into place, so one interactive edit emits several PATH records for the same target.
Backup, restore and home-directory migration jobs that unpack an archive over a user's home directory, recreating every dotfile in it.

Lessonregistry persistence

registry persistenceAI draft — unreviewed

01 · What this rule detects

An auditd PATH record naming a shell startup or logout script — the file-modification half of AN0059. Persistence here is a line appended to a file the shell sources on its own, so it re-executes at every login. The rule sees the write. It does not see what was written.

02 · Telemetry you need

auditd (product: linux, service: auditd, taken verbatim from the brief).
Watches. auditd watches none of these paths by default, so on a stock host
Field names. The rule uses raw type and name, which is Sigma's auditd

03 · How the logic works

Two selections joined by condition: 1 of selection*. selection_dotfiles pins type: 'PATH' and runs name|endswith over 24 paths: the bash and sh per-user dotfiles, the five zsh dotfiles, plus system-wide /etc/profile, both the Debian /etc/bash.bashrc and RHEL /etc/bashrc layouts, and zsh's system config in both the /etc/zsh/ and the bare /etc/ arrangement. That list fills MITRE's FilePathRegex knob; MITRE names the knob, the paths are the pipeline's own. Matching on the filename rather than an absolute path is deliberate: auditd records name= exactly as it was handed to the syscall, so an editor run from inside a home directory logs a bare .bashrc, which any absolute selector misses. selection_profiled is name|contains: '/etc/profile.d/' — and it inherits none of that reasoning. cd /etc/profile.d && cat > 00-x.sh emits name="00-x.sh" and matches neither selection. The drop-in directory is the cheapest half of this technique to abuse, and a relative write walks straight past it. Two limits are structural. auditd splits one event into PATH and SYSCALL records, and exe, uid and auid live only on the SYSCALL side, so MITRE's TargetUser knob cannot be applied inside this selection at all. The analytic's second half — an unexpected binary executing shortly after shell startup, inside MITRE's TimeWindow knob — is cross-event correlation that lib/sigma has no way to express. The macOS arm, AN0060, is not attempted.

04 · Common false positives

Configuration management (Ansible, Chef, Puppet, Salt) and dotfile tooling
Package installs: /etc/profile.d/ fragments dropped by postinst scripts, and
useradd copying /etc/skel into each new home — a burst per provisioned
Ordinary users editing their own shell config. Editors write through a temp
Louder than any of those, if the watch mask includes r or an existing ruleset

05 · Detection maturity

tier_1: **, and it stays there until someone runs it against real data. Nothing here has touched a log line. level: low is the author's judgement about a managed estate, not a measurement, and the reviewer's read is that the read-watch case could beat it outright.
tier_2: begins with deploying the watches, running the rule over history, and finding out which of the five false positives actually dominates.
tier_3: adds the process-creation leg and the correlation MITRE describes, which is where this stops being a file-name list.

Related detections2 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/a01eef05-d4a9-4665-b1fb-7f7d1dcc10bd

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Shell startup or logout script modified on Linux

The detection

detection.yml

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Sentinel · KQL

Community

Verdicts from engineers who deployed it