tfMITRE ATT&CK sub-technique

Unix Shell Configuration Modification T1546.004

sub-technique of T1546 Event Triggered Execution

Tactics: Persistence, Privilege Escalation
Platforms: Linux, macOS
Version: 2.2
Created: 24 January 2020
Last modified: 12 May 2026
Contributors: Robert Wilson; Tony Lambert, Red Canary

Adversaries may establish persistence through executing malicious commands triggered by a user’s shell. User Unix Shells execute several configuration scripts at different points throughout the session based on events. For example, when a user opens a command-line interface or remotely logs in (such as via SSH) a login shell is initiated. The login shell executes scripts from the system (/etc) and the user’s home directory (~/) to configure the environment. All login shells on a system use /etc/profile when initiated. These configuration scripts run at the permission level of their directory and are often used to set environment variables, create aliases, and customize the user’s environment. When the shell exits or terminates, additional shell scripts are executed to ensure the shell exits appropriately.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware66th pct

Tools & malware66th percentile · 66% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules60th pct

Detection rules60th percentile · 60% of ATT&CK techniques have this many detection rules written or fewer.

Unix Shell Configuration Modification MITRE reference T1546.004

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Contagious InterviewG1052 ↗

Has targeted macOS victim hosts using a bash downloader coremedia.sh and a bash script cloud.sh.1

created 2025-10-191 referenceaka DeceptiveDevelopment

All 1 groups for this technique

5 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

PHASEJAMS9014 ↗

Has used a bash script to modify components on Ivanti Connect Secure appliances and execute files via /bin/bash.[1] It has also used the Linux stream editor (sed) to execute commands.1

created 2026-04-16MALWARE

RotaJakiroS1078 ↗

When executing with non-root level permissions, RotaJakiro can install persistence by adding a command to the .bashrc file that executes a binary in the ${HOME}/.gvfsd/.profile/ folder.1

created 2023-06-14MALWAREcarried by 1 group

Green LambertS0690 ↗

Can establish persistence on a compromised host through modifying the profile, login, and run command (rc) files associated with the bash, csh, and tcsh shells. 1 2

created 2022-03-21MALWARE

XCSSETS0658 ↗

Using AppleScript, XCSSET adds it's executable to the user's ~/.zshrc_aliases file ("echo " & payload & " > ~/zshrc_aliases"), it then adds a line to the .zshrc file to source the .zshrc_aliases file ([ -f $HOME/.zshrc_aliases ] && . $HOME/.zshrc_aliases). Each time the user starts a new zsh terminal session, the .zshrc file executes the .zshrc_aliases file.1

created 2021-10-05MALWARE

Linux RabbitS0362 ↗

Maintains persistence on an infected machine through rc.local and .bashrc files. 1

created 2019-03-04MALWARE

All 5 software entries for this technique

Offense vs defense T1546.004

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 3

first rule: 2021 Q4 · 1 of 1 campaigns plotted

Unix Shell Configuration Modification detection strategy DET0020

MITRE names one behaviour worth catching for this technique and breaks it into 2 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect Shell Configuration Modification for Persistence via Event-Triggered Execution

Enterprise

2 platforms

AN0059 · Linux

Detects modification of shell startup/logout scripts such as ~/.bashrc, ~/.bash_profile, or /etc/profile, followed by anomalous process execution or network connections upon interactive or remote shell login.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:EXECVE	execution of unexpected binaries during user shell startup
File ModificationDC0061	auditd:SYSCALL	AUDIT_SYSCALL (open, write, rename, unlink)
Network Traffic ContentDC0085	NSM:Flow	unexpected network activity initiated shortly after shell session starts

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Defines how soon after shell startup process execution or network activity is considered suspicious.
TargetUser	Limits detection to specific user accounts or roles such as root or service accounts.
FilePathRegex	Defines what shell configuration paths are considered relevant (e.g., .bashrc, .bash_logout, etc.)

AN0060 · macOS

Correlates zsh shell configuration file changes (e.g., ~/.zshrc, ~/.zlogin, /etc/zprofile) with execution of unauthorized binaries or unexpected network activity triggered on Terminal.app launch.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	launch of Terminal.app or shell with non-standard environment setup
File ModificationDC0061	macos:endpointsecurity	ES_EVENT_TYPE_NOTIFY_WRITE, targeting .zshrc, .zlogin, .zprofile

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
FileTargetList	Customizable list of shell config files considered sensitive for detection.
PayloadEntropyThreshold	Used to distinguish benign from potentially obfuscated commands written to config files.
UserContext	Scoping based on user login class, e.g., administrative vs standard users.

Tests7Executorssh 6 · bash 1Need elevation3 of 7Have prerequisites0Have cleanup7Platformsmacos, linux

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Add command to .bash_profile

macos, linux

—

Yes

Adds a command to the .bash_profile file of the current user

Input arguments

Name	Type	Default	Description
command_to_add	string	echo "Hello from Atomic Red Team T1546.004" > /tmp/T1546.004	Command to add to the .bash_profile file

Attack command

echo '#{command_to_add}' >> ~/.bash_profile

Cleanup command

head -n '-2' ~/.bash_profile > /tmp/T1546.004
mv /tmp/T1546.004 ~/.bash_profile

GUID98b29ca5-d727-4d33-af83-a9820a7ace8f

Add command to .bashrc

macos, linux

—

Yes

Adds a command to the .bashrc file of the current user

Input arguments

Name	Type	Default	Description
command_to_add	string	echo "Hello from Atomic Red Team T1546.004" > /tmp/T1546.004	Command to add to the .bashrc file

Attack command

echo '#{command_to_add}' >> ~/.bashrc

Cleanup command

head -n '-2' ~/.bashrc > /tmp/T1546.004
mv /tmp/T1546.004 ~/.bashrc

GUIDe2f14af3-3986-471c-bc10-70cb816f7bd3

Add command to .shrc

linux

—

Yes

Adds a command to the .shrc file of the current user

Input arguments

Name	Type	Default	Description
command_to_add	string	echo "Hello from Atomic Red Team T1546.004" > /tmp/T1546.004	Command to add to the .shrc file

Attack command

echo '#{command_to_add}' >> ~/.shrc

Cleanup command

head -n '-2' ~/.shrc > /tmp/T1546.004
mv /tmp/T1546.004 ~/.shrc

GUID838e7457-8e39-4633-9168-c35b892f86bc

Append to the system shell profile

linux

Required

—

Yes

An adversary may wish to establish persistence by executing malicious commands from the systems /etc/profile every time "any" user logs in.

Input arguments

Name	Type	Default	Description
text_to_append	string	# Hello from Atomic Red Team T1546.004	Text to append to the /etc/profile file

Attack command

echo '#{text_to_append}' >> /etc/profile

Cleanup command

sed -i "s/# Atomic Red Team was here! T1546.004//" /etc/profile

GUIDb727c78c-8f55-482f-ac31-14a841fac852

Append commands user shell profile

linux

—

Yes

An adversary may wish to establish persistence by executing malicious commands from the users ~/.profile every time the "user" logs in.

Input arguments

Name	Type	Default	Description
text_to_append	string	# Atomic Red Team was here... T1546.004	Text to append to the ~/.profile file

Attack command

echo '#{text_to_append}' >> ~/.profile

Cleanup command

sed -i "s/# Atomic Red Team was here... T1546.004//" ~/.profile

GUID87db1b39-4c27-4fc0-9138-7e830712d9be

System shell profile scripts

linux

Required

—

Yes

An adversary may wish to establish persistence by adding commands into any of the script files in the /etc/profile.d/ directory, which are executed every time "any" user logs in.

Input arguments

Name	Type	Default	Description
text_to_append	string	# Atomic Red Team was here... T1546.004	Text to append to the /etc/profile.d/bash_completion.sh file

Attack command

echo '#{text_to_append}' >> /etc/profile.d/bash_completion.sh

Cleanup command

sed -i "s/# Atomic Red Team was here... T1546.004//" /etc/profile.d/bash_completion.sh

GUID9b532530-b326-4a11-ac11-662e7c4cd5d9

Create/Append to .bash_logout

linux

bash

Required

—

Yes

Tests from Atomic Red Team (MIT licence) · technique definition

Unix Shell Configuration Modification detections T1546.004

4 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

60th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs