Sigma rule: Unix Shell Configuration Modification

Rule

Title

Unix Shell Configuration Modification

Status

test

Level

medium

Author

Peter Matkovski, IAI

Date

2023-03-06

Modified

2023-03-15

File

rules/linux/auditd/path/lnx_auditd_unix_shell_configuration_modification.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detect unix shell configuration modification. Adversaries may establish persistence through executing malicious commands triggered when a new shell is opened.

Log source

product

linux

service

auditd

Detection

selection:
    type: 'PATH'
    name:
        - '/etc/shells'
        - '/etc/profile'
        - '/etc/profile.d/*'
        - '/etc/bash.bashrc'
        - '/etc/bashrc'
        - '/etc/zsh/zprofile'
        - '/etc/zsh/zshrc'
        - '/etc/zsh/zlogin'
        - '/etc/zsh/zlogout'
        - '/etc/csh.cshrc'
        - '/etc/csh.login'
        - '/root/.bashrc'
        - '/root/.bash_profile'
        - '/root/.profile'
        - '/root/.zshrc'
        - '/root/.zprofile'
        - '/home/*/.bashrc'
        - '/home/*/.zshrc'
        - '/home/*/.bash_profile'
        - '/home/*/.zprofile'
        - '/home/*/.profile'
        - '/home/*/.bash_login'
        - '/home/*/.bash_logout'
        - '/home/*/.zlogin'
        - '/home/*/.zlogout'
condition: selection

False positives (as the rule lists them)

• Admin or User activity are expected to generate some false positives

Tags

• attack.privilege-escalation
• attack.persistence
• attack.t1546.004

MITRE ATT&CK ids this rule names

• T1546.004

Related rules

• e74e15cc-c4b6-4c80-b7eb-dfe49feb7fe9 (obsolete)

References

• https://objective-see.org/blog/blog_0x68.html
• https://web.archive.org/web/20221204161143/https://www.glitch-cat.com/p/green-lambert-and-attack
• https://www.anomali.com/blog/pulling-linux-rabbit-rabbot-malware-out-of-a-hat

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/linux/auditd/path/lnx_auditd_unix_shell_configuration_modification.yml