Trap command written into a shell startup file

Siemphony@siemphonylowT1546.005unverified

Matches a Linux process whose command line registers a `trap` handler and names a shell startup file in the same invocation — the shape a one-liner takes when it appends `trap 'payload' INT` to ~/.bashrc, whether written with `bash -c`, `sed -i`, `perl -pi -e` or `tee`. The gate is the command line alone and not the `Image`, because the write is performed by whatever tool the operator reached for, and on auditd execve the recorded binary is the interpreter rather than the wrapper. Note two limits, both of which belong to the telemetry rather than to the logic: `trap` and `echo` are shell builtins, so a handler typed at an interactive prompt and redirected into a dotfile produces no execve at all and cannot be seen here; and AN1038's second half — correlating the insertion with a child process spawned when SIGINT later fires — is a join across two events that Sigma has no operator for, so only the insertion is covered. auditd does not record execve out of the box, so this rule is blind until an audit rule such as `-a always,exit -F arch=b64 -S execve` is loaded; zero matches without it means unmonitored, not clean. macOS (AN1039) is out of scope: its unified-log fields are not standardised in Sigma. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0369, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (ProcessCommandLine contains "trap " and (ProcessCommandLine contains ".bashrc" or ProcessCommandLine contains ".bash_profile" or ProcessCommandLine contains ".bash_login" or ProcessCommandLine contains ".profile" or ProcessCommandLine contains ".zshrc" or ProcessCommandLine contains ".zprofile" or ProcessCommandLine contains ".zlogin" or ProcessCommandLine contains "/etc/profile" or ProcessCommandLine contains "/etc/bash.bashrc"))

Splunk · SPL

Run this as a search.

index=* (CommandLine="*trap *" AND (CommandLine="*.bashrc*" OR CommandLine="*.bash_profile*" OR CommandLine="*.bash_login*" OR CommandLine="*.profile*" OR CommandLine="*.zshrc*" OR CommandLine="*.zprofile*" OR CommandLine="*.zlogin*" OR CommandLine="*/etc/profile*" OR CommandLine="*/etc/bash.bashrc*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.command_line) LIKE "*trap *" AND (TO_LOWER(process.command_line) LIKE "*.bashrc*" OR TO_LOWER(process.command_line) LIKE "*.bash_profile*" OR TO_LOWER(process.command_line) LIKE "*.bash_login*" OR TO_LOWER(process.command_line) LIKE "*.profile*" OR TO_LOWER(process.command_line) LIKE "*.zshrc*" OR TO_LOWER(process.command_line) LIKE "*.zprofile*" OR TO_LOWER(process.command_line) LIKE "*.zlogin*" OR TO_LOWER(process.command_line) LIKE "*/etc/profile*" OR TO_LOWER(process.command_line) LIKE "*/etc/bash.bashrc*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)trap </field>    <field name="CommandLine" type="pcre2">(?i)(\.bashrc|\.bash_profile|\.bash_login|\.profile|\.zshrc|\.zprofile|\.zlogin|/etc/profile|/etc/bash\.bashrc)</field>    <description>Trap command written into a shell startup file</description>    <mitre>      <id>T1546.005</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / linux
Level: low
Category: registry_persistence
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: c07f7012-d36e-45c2-bcb7-5c3bd8422887

ATT&CKT1546.005

T1546.005Trap

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonregistry persistence

registry persistenceAI draft — unreviewed

01 · What this rule detects

A shell trap handler being installed into a startup file on Linux. MITRE's AN1038 describes the insertion of a trap statement into a login shell config, so that a later signal — typically SIGINT when the user presses Ctrl-C — executes the adversary's payload. The rule catches the insertion moment: a process whose command line both registers a trap and names a shell startup file in the same invocation.

02 · Telemetry you need

Linux process creation with the full command line, which in practice means auditd execve. auditd records no execve by default, so the rule is blind until a rule such as -a always,exit -F arch=b64 -S execve is loaded — zero matches without it means unmonitored, not clean. macOS (AN1039) is out of scope here: its unified-log fields are not standardised in Sigma, so a rule written against them would be guesswork.

03 · How the logic works

Two blocks, ANDed, and both look at CommandLine only. selection_trap matches CommandLine|contains: 'trap ' — with the trailing space, so it hits the command rather than words like "traproute" or a path containing "trap". selection_profile matches CommandLine|contains against nine startup paths: .bashrc, .bash_profile, .bash_login, .profile, .zshrc, .zprofile, .zlogin, /etc/profile and /etc/bash.bashrc. The deliberate choice here is that Image is not gated at all. The write is performed by whatever tool the operator reached for — bash -c, sed -i, perl -pi -e, tee — and on auditd execve the recorded exe= is the interpreter rather than any wrapper, so pinning the binary would narrow the rule to one of several equivalent one-liners for no gain. MITRE names two relevant knobs: TargetShellFilePath, which is the intended home for that path list, and SignalTrapName, for which signals to care about. The nine paths above are the pipeline's own population of the first knob, and the rule does not gate on signal name at all, so SignalTrapName is left entirely open. Two limits belong to the telemetry rather than the logic. trap and echo are shell builtins, so a handler typed at an interactive prompt and redirected into a dotfile creates no execve and cannot be seen here at all. And AN1038's second half — correlating the insertion with the child process spawned when the signal later fires — is a join across two events, and Sigma has no operator for that, so only the insertion is covered.

04 · Common false positives

The loudest source on any managed fleet is configuration management. An Ansible ansible.builtin.shell task, a Puppet exec, or a cloud-init bootstrap script will commonly install a cleanup trap and append PATH or proxy settings to ~/.bashrc inside a single /bin/sh -c invocation, matching both blocks at once. Next comes reading rather than writing: grep -n trap ~/.bashrc or sed -n against ~/.zshrc puts the word and the path on the same command line while changing nothing, and the rule cannot tell read from write. Hardening and compliance scanners — CIS benchmark scripts, Lynis — do exactly that on a schedule from a service account, producing a steady low-rate hum. The level is low for that reason.

05 · Detection maturity

tier_1: Lowest tier, and it stays there until the rule has been run against real data. It is machine-derived from a MITRE scaffold and has never been executed against a single log line, so the 'trap ' substring behaviour, the path coverage and the noise volume are untested assumptions rather than findings. Run it over history, count how much of the output is Ansible, and start there.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Exclude the automation identities first: the config-management service account and the scanner account will account for most of the volume and are stable. Then split read from write if your parser allows it — adding a required redirection or an in-place edit flag (>>, -i, tee -a) turns the inspection noise off, at the cost of missing writers that use other syntax. Extend selection_profile with any site-specific profile drop-ins under /etc/profile.d/, which the shipped list does not cover. Since the builtin blind spot is real, pair this with file-integrity monitoring on the same nine paths; the two together cover cases neither sees alone.

Declared by the author

Configuration management and provisioning runs — an Ansible ansible.builtin.shell task, a Puppet exec, or a cloud-init bootstrap script — that install a cleanup trap and append PATH or proxy settings to ~/.bashrc inside a single /bin/sh -c invocation, which is by a wide margin the loudest match on any managed fleet.
An administrator or developer inspecting their own dotfiles, for example grep -n trap ~/.bashrc or sed -n on ~/.zshrc, which puts the word trap and the profile path on the same command line without changing anything.
Hardening and compliance scanners such as CIS benchmark or Lynis scripts that grep shell startup files for trap statements on a schedule, producing a steady low-rate match from the scanner's own service account.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1546.005, evaluated against their process_creation events.

Share this rule

/u/siemphony/c07f7012-d36e-45c2-bcb7-5c3bd8422887

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Trap command written into a shell startup file

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it