tfMITRE ATT&CK sub-technique

Trap T1546.005

sub-technique of T1546 Event Triggered Execution

Tactics: Persistence, Privilege Escalation
Platforms: macOS, Linux
Version: 1.1
Created: 24 January 2020
Last modified: 24 October 2025

Adversaries may establish persistence by executing malicious content triggered by an interrupt signal. The trap command allows programs and shells to specify commands that will be executed upon receiving interrupt signals. A common situation is a script allowing for graceful termination and handling of common keyboard interrupts like ctrl+c and ctrl+d.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Offense vs defense T1546.005

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Trap detection strategy DET0369

MITRE names one behaviour worth catching for this technique and breaks it into 2 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Event Triggered Execution via Trap (T1546.005)

Enterprise

2 platforms

AN1038 · Linux

Correlate file modifications in shell startup scripts (e.g., .bashrc, .profile) with embedded trap commands and observe if those changes are followed by the unexpected execution of child processes when terminal signals (e.g., SIGINT) are triggered. Use contextual linking with user session activity to detect privilege misuse.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
File AccessDC0055	auditd:SYSCALL	open
File ModificationDC0061	auditd:SYSCALL	Modification of user shell profile or trap registration via echo/redirection (e.g., echo "trap 'malicious_cmd' INT" >> ~/.bashrc)

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TargetShellFilePath	The path to user profile scripts (e.g., ~/.bashrc, ~/.zshrc); may differ by distro or shell type.
SignalTrapName	Trap signal (e.g., INT, HUP, TERM) can be environment-specific or attacker-tuned to evade.
TimeWindow	Temporal threshold to correlate trap insertion and process execution (e.g., 10s-5min)

AN1039 · macOS

Detect unauthorized trap command registrations in shell startup files (e.g., .zprofile, .bash_profile, .zshrc) followed by execution chains during user terminal interaction. Use Unified Logs and EDR telemetry to correlate shell command parsing and process tree anomalies.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	Command line containing `trap` or `echo 'trap` written to login shell files
File ModificationDC0061	macos:unifiedlog	File write or append to .zshrc, .bash_profile, .zprofile, etc.

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
LoginShellConfigPaths	Startup files vary by shell (.bash_profile, .zshrc, etc.)
TrapCommandLengthThreshold	Short benign traps may differ from longer/multi-command malicious traps
ParentProcessAnomalyThreshold	Score or detect if new child process deviates from shell’s typical behavior

Tests5Executorssh 4 · bash 1Need elevation0 of 5Have prerequisites2Have cleanup5Platformsmacos, linux

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup
01	Trap EXIT	macos, linux	sh	—	—	Yes
Launch bash shell with command arg to create TRAP on EXIT. The trap executes script that writes to /tmp/art-fish.txt Attack command bash -c 'trap "nohup sh $PathToAtomicsFolder/T1546.005/src/echo-art-fish.sh" EXIT' Cleanup command rm -f /tmp/art-fish.txt GUID679e36c9-6c6b-4681-b407-418020b8bfe8
02	Trap EXIT (freebsd)	linux	sh	—	1	Yes
Launch bash shell with command arg to create TRAP on EXIT. The trap executes script that writes to /tmp/art-fish.txt Attack command bash -c 'trap "nohup sh $PathToAtomicsFolder/T1546.005/src/echo-art-fish.sh" EXIT' Cleanup command rm -f /tmp/art-fish.txt Prerequisite Check if bash is installed. Check if [ ! -x "$(command -v bash)" ]; then exit 1; else exit 0; fi; Satisfy (which pkg && pkg install -y bash) GUIDe5b397d9-f9ac-479f-9bc0-ddc7dd29aa12
03	Trap SIGINT	macos, linux	sh	—	—	Yes
Launch bash shell with command arg to create TRAP on SIGINT (CTRL+C), then send SIGINT signal. The trap executes script that writes to /tmp/art-fish.txt Attack command bash -c 'trap "nohup sh $PathToAtomicsFolder/T1546.005/src/echo-art-fish.sh" SIGINT && kill -SIGINT $$' Cleanup command rm -f /tmp/art-fish.txt GUID59652d34-5b6d-42bc-bfe6-9eff77201243
04	Trap SIGINT (freebsd)	linux	sh	—	1	Yes
Launch bash shell with command arg to create TRAP on SIGINT (CTRL+C), then send SIGINT signal. The trap executes script that writes to /tmp/art-fish.txt Attack command bash -c 'trap "nohup sh $PathToAtomicsFolder/T1546.005/src/echo-art-fish.sh" SIGINT && kill -SIGINT $$' Cleanup command rm -f /tmp/art-fish.txt Prerequisite Check if bash is installed. Check if [ ! -x "$(command -v bash)" ]; then exit 1; else exit 0; fi; Satisfy (which pkg && pkg install -y bash) GUID72a5fae0-aabe-437c-8c98-9cd712dfddb1
05	Trap DEBUG - Log All Shell Commands	linux, macos	bash	—	—	Yes
Launch bash shell with command arg to create TRAP on DEBUG. The trap logs executed commands to /tmp/art-fish.txt, simulating persistent command interception. Attack command trap 'echo "$BASH_COMMAND" >> /tmp/art-fish.txt' DEBUG whoami id hostname cat /tmp/art-fish.txt Cleanup command rm -f /tmp/art-fish.txt GUIDce164280-edb6-4664-8b0d-fb5c2d85a583

Tests from Atomic Red Team (MIT licence) · technique definition

Trap detections T1546.005

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs