cyberstrikeus T1546.005 Trap
Sub-technique of: T1546
High-Level Description
Adversaries may establish persistence by executing malicious content triggered by an interrupt signal. The trap command allows programs and shells to specify commands that will be executed upon receiving interrupt signals. A common situation is a script allowing for graceful termination and handling of common keyboard interrupts like ctrl+c and ctrl+d.
Adversaries can use this to register code to be executed when the shell encounters specific interrupts as a persistence mechanism. Trap commands are of the following format trap 'command list' signals where "command list" will be executed when "signals" are received.
Kill Chain Phase
- Privilege Escalation (TA0004)
- Persistence (TA0003)
Platforms: macOS, Linux
What to Check
- Identify if Trap technique is applicable to target environment
- Check macOS systems for indicators of Trap
- Check Linux systems for indicators of Trap
- Assess detection coverage (1 detection strategies)
How to Test
Atomic Red Team Tests
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Atomic Test 1: Trap EXIT
Launch bash shell with command arg to create TRAP on EXIT. The trap executes script that writes to /tmp/art-fish.txt
Supported Platforms: macos, linux
bash -c 'trap "nohup sh $PathToAtomicsFolder/T1546.005/src/echo-art-fish.sh" EXIT'
Atomic Test 2: Trap EXIT (freebsd)
Launch bash shell with command arg to create TRAP on EXIT. The trap executes script that writes to /tmp/art-fish.txt
Supported Platforms: linux
bash -c 'trap "nohup sh $PathToAtomicsFolder/T1546.005/src/echo-art-fish.sh" EXIT'
Dependencies:
- Check if bash is installed.
Atomic Test 3: Trap SIGINT
Launch bash shell with command arg to create TRAP on SIGINT (CTRL+C), then send SIGINT signal. The trap executes script that writes to /tmp/art-fish.txt
Supported Platforms: macos, linux
bash -c 'trap "nohup sh $PathToAtomicsFolder/T1546.005/src/echo-art-fish.sh" SIGINT && kill -SIGINT $$'
Atomic Test 4: Trap SIGINT (freebsd)
Launch bash shell with command arg to create TRAP on SIGINT (CTRL+C), then send SIGINT signal. The trap executes script that writes to /tmp/art-fish.txt
Supported Platforms: linux
bash -c 'trap "nohup sh $PathToAtomicsFolder/T1546.005/src/echo-art-fish.sh" SIGINT && kill -SIGINT $$'
Dependencies:
- Check if bash is installed.
Manual Testing
If Atomic Red Team tests are not applicable, manually verify the technique by:
Identify Attack Surface: Determine if the target environment is susceptible to Trap by examining the target platforms (macOS, Linux).
Assess Existing Defenses: Review whether mitigations for T1546.005 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Remediation Guide
No specific mitigations documented for this technique.
Detection
Detection Strategy for Event Triggered Execution via Trap (T1546.005)
Risk Assessment
| Finding | Severity | Impact |
|---|---|---|
| Trap technique applicable | Low | Privilege Escalation |
CWE Categories
| CWE ID | Title |
|---|---|
| CWE-269 | Improper Privilege Management |