UNC3886G1048 ↗
Modified the startup file /etc/init.d/localnet to execute the line nohup /bin/support & so the script would run when the system was rebooted.1
tfMITRE ATT&CK sub-technique
Ignore Process Interrupts T1564.011
sub-technique of T1564 Hide Artifacts
- Tactic
- Stealth
- Platforms
- Linux, macOS, Windows
- Version
- 2.0
- Created
- 24 August 2023
- Last modified
- 12 May 2026
- Contributor
- Viren Chaudhari, Qualys
Adversaries may evade defensive mechanisms by executing commands that hide from process interrupt signals. Many operating systems use signals to deliver messages to control process behavior. Command interpreters often include specific commands/flags that ignore errors and other hangups, such as when the user of the active session logs off.[1] These interrupt signals may also be used by defensive tools and/or analysts to pause or terminate specified running processes.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
3
Threat groups64th pct
Threat groups64th percentile · 64% of ATT&CK techniques have this many threat groups attributed or fewer.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.6
Tools & malware68th pct
Tools & malware68th percentile · 68% of ATT&CK techniques have this many tools implementing them or fewer.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Ignore Process Interrupts MITRE reference T1564.011
64th pctamong all ATT&CK techniques for number of groups
3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Sea TurtleG1041 ↗
Executed SnappyTCP using the tool NoHup, which keeps the malware running on a system after exiting the shell or terminal.1
KimsukyG0094 ↗
Has leveraged the PowerShell -ErrorAction SilentlyContinue command to continue execution through system events.1
All 3 groups for this technique
6 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Mini Shai-HuludS9043 ↗
Has suppressed output so that nothing is printed to terminal and has utilized silent exiting when environmental variables match restricted values.1
Shai-HuludS9008 ↗
Has suppressed NPM warnings by silently exiting through the use of the NPM success code that has a setting that all errors exit with code 0.1
BOLDMOVES1184 ↗
Calls the signal function to ignore the signals SIGCHLD, SIGHIP, and SIGPIPE prior to starting primary logic.1
BPFDoorS1161 ↗
Sets its process to ignore the following signals; SIGHUP, SIGINT, SIGQUIT, SIGPIPE, SIGCHLD, SIGTTIN, and SIGTTOU.1
GoldMaxS0588 ↗
The GoldMax Linux variant has been executed with the nohup command to ignore hangup signals and continue to run if the terminal session was terminated.1
OSX/ShlayerS0402 ↗
Has used the nohup command to instruct executed payloads to ignore hangup signals.1
All 6 software entries for this technique
Offense vs defense T1564.011
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Ignore Process Interrupts detection strategy DET0067
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Ignore Process Interrupts
3 platforms
AN0181 · Linux
Execution of processes using nohup or shell redirection to ignore SIGHUP and continue running after session termination. Defender perspective: correlation between commands including nohup, disowned jobs, or & suffix with continued process execution after parent terminal exit.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | process persists beyond parent shell termination |
| Command ExecutionDC0064 | auditd:SYSCALL | execve call including 'nohup' or trailing '&' |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| IgnoredSignals | Specific signals to monitor (e.g., SIGHUP, SIGINT) depending on environment baseline. |
| ProcessLifetimeThreshold | Duration a process continues running after session logout, adjustable to reduce noise from benign long-lived jobs. |
AN0182 · Windows
PowerShell or script execution with parameters that suppress errors or ignore user interrupts, such as -ErrorAction SilentlyContinue. Defender perspective: detecting discrepancies between suppressed error arguments and continued execution behavior.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Command ExecutionDC0064 | WinEventLog:PowerShell | EventCode=4103, 4104, 4105, 4106 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MonitoredCmdlets | List of PowerShell cmdlets where suppressed error handling is suspicious (e.g., Invoke-Expression, Invoke-WebRequest). |
| ErrorActionThreshold | Frequency of suppressed error actions within time window that should trigger detection. |
AN0183 · macOS
Use of nohup, disown, or AppleScript constructs to suppress process interrupts. Defender perspective: commands containing nohup or hidden background tasks (osascript with persistent execution) correlated with processes surviving user logouts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | background process persists beyond user logout |
| Command ExecutionDC0064 | macos:unifiedlog | nohup, disown, or osascript execution patterns |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| WatchedShells | Shells or interpreters where nohup/disown usage is suspicious, configurable to environment. |
| PersistenceCorrelationWindow | Time window to correlate process continuation after logout with suspicious commands. |