Sigma rule: Edit of .bash_profile and .bashrc

Rule

Title

Edit of .bash_profile and .bashrc

Status

deprecated

Level

medium

Author

Peter Matkovski

Date

2019/05/12

Modified

2023/03/23

File

deprecated/linux/lnx_auditd_alter_bash_profile.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects change of user environment. Adversaries can insert code into these files to gain persistence each time a user logs in or opens a new shell.

Log source

product

linux

service

auditd

Detection

selection:
    type: 'PATH'
    name:
        - '/root/.bashrc'
        - '/root/.bash_profile'
        - '/root/.profile'
        - '/home/*/.bashrc'
        - '/home/*/.bash_profile'
        - '/home/*/.profile'
        - '/etc/profile'
        - '/etc/shells'
        - '/etc/bashrc'
        - '/etc/csh.cshrc'
        - '/etc/csh.login'
condition: selection

False positives (as the rule lists them)

• Admin or User activity

Tags

• attack.s0003
• attack.persistence
• attack.t1546.004

MITRE ATT&CK ids this rule names

• S0003
• T1546.004

References

• MITRE Attack technique T1156; .bash_profile and .bashrc.

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/deprecated/linux/lnx_auditd_alter_bash_profile.yml