{"id":"a94cdd87-6c54-4678-a6cc-2814ffe5a13d","title":"Unix Shell Configuration Modification","description":"Detect unix shell configuration modification. Adversaries may establish persistence through executing malicious commands triggered when a new shell is opened.","author":"Peter Matkovski, IAI","status":"test","level":"medium","date":"2023-03-06","modified":"2023-03-15","tags":["attack.privilege-escalation","attack.persistence","attack.t1546.004"],"technique_ids":["T1546.004"],"logsource":{"product":"linux","service":"auditd"},"falsepositives":["Admin or User activity are expected to generate some false positives"],"references":["https://objective-see.org/blog/blog_0x68.html","https://web.archive.org/web/20221204161143/https://www.glitch-cat.com/p/green-lambert-and-attack","https://www.anomali.com/blog/pulling-linux-rabbit-rabbot-malware-out-of-a-hat"],"source_path":"rules/linux/auditd/path/lnx_auditd_unix_shell_configuration_modification.yml","source_sha256":"42c6895752245758d4c2dd68e6bece3876c73df418f9ee2d6b41f4ba411c7c9a","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/path/lnx_auditd_unix_shell_configuration_modification.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Unix Shell Configuration Modification\nid: a94cdd87-6c54-4678-a6cc-2814ffe5a13d\nrelated:\n    - id: e74e15cc-c4b6-4c80-b7eb-dfe49feb7fe9\n      type: obsolete\nstatus: test\ndescription: Detect unix shell configuration modification. Adversaries may establish persistence through executing malicious commands triggered when a new shell is opened.\nreferences:\n    - https://objective-see.org/blog/blog_0x68.html\n    - https://web.archive.org/web/20221204161143/https://www.glitch-cat.com/p/green-lambert-and-attack\n    - https://www.anomali.com/blog/pulling-linux-rabbit-rabbot-malware-out-of-a-hat\nauthor: Peter Matkovski, IAI\ndate: 2023-03-06\nmodified: 2023-03-15\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.t1546.004\nlogsource:\n    product: linux\n    service: auditd\ndetection:\n    selection:\n        type: 'PATH'\n        name:\n            - '/etc/shells'\n            - '/etc/profile'\n            - '/etc/profile.d/*'\n            - '/etc/bash.bashrc'\n            - '/etc/bashrc'\n            - '/etc/zsh/zprofile'\n            - '/etc/zsh/zshrc'\n            - '/etc/zsh/zlogin'\n            - '/etc/zsh/zlogout'\n            - '/etc/csh.cshrc'\n            - '/etc/csh.login'\n            - '/root/.bashrc'\n            - '/root/.bash_profile'\n            - '/root/.profile'\n            - '/root/.zshrc'\n            - '/root/.zprofile'\n            - '/home/*/.bashrc'\n            - '/home/*/.zshrc'\n            - '/home/*/.bash_profile'\n            - '/home/*/.zprofile'\n            - '/home/*/.profile'\n            - '/home/*/.bash_login'\n            - '/home/*/.bash_logout'\n            - '/home/*/.zlogin'\n            - '/home/*/.zlogout'\n    condition: selection\nfalsepositives:\n    - Admin or User activity are expected to generate some false positives\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1546.004","id":"T1546.004","name":"Unix Shell Configuration Modification","page":"techniques/enterprise/T1546.004/"}],"data_path":"data/detection-rules/a94cdd87-6c54-4678-a6cc-2814ffe5a13d.json","kind":"sigma"}