Techniques › T1546 › T1546.005

T1546.005 Trap

privilege escalation · persistence — macOS, Linux · attack.mitre.org · JSON

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

• DET0369 Detection Strategy for Event Triggered Execution via Trap (T1546.005) v1.0
  AN1038 Linux

  Correlate file modifications in shell startup scripts (e.g., .bashrc, .profile) with embedded trap commands and observe if those changes are followed by the unexpected execution of child processes when terminal signals (e.g., SIGINT) are triggered. Use contextual linking with user session activity to detect privilege misuse.

  auditd:SYSCALL execve → DC0032 Process Creation

  auditd:SYSCALL Modification of user shell profile or trap registration via echo/redirection (e.g., echo "trap 'malicious_cmd' INT" >> ~/.bashrc) → DC0061 File Modification

  auditd:SYSCALL open → DC0055 File Access

  Tunable: TargetShellFilePath SignalTrapName TimeWindow
  AN1039 macOS

  Detect unauthorized trap command registrations in shell startup files (e.g., .zprofile, .bash_profile, .zshrc) followed by execution chains during user terminal interaction. Use Unified Logs and EDR telemetry to correlate shell command parsing and process tree anomalies.

  macos:unifiedlog Command line containing `trap` or `echo 'trap` written to login shell files → DC0032 Process Creation

  macos:unifiedlog File write or append to .zshrc, .bash_profile, .zprofile, etc. → DC0061 File Modification

  Tunable: LoginShellConfigPaths TrapCommandLengthThreshold ParentProcessAnomalyThreshold

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1546.005

Rules tagged at the parent level (attack.t1546) 10

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.