T1546.004 — Unix Shell Configuration Modification

Tactics: Privilege Escalation, Persistence · Platforms: Linux, macOS

Adversaries may establish persistence through executing malicious commands triggered by a user’s shell. User Unix Shells execute several configuration scripts at different points throughout the session based on events. For example, when a user opens a command-line interface or remotely logs in…

Sub-technique of Event Triggered Execution (T1546).

Sigma detection rules (2)

T1546.004 Event Triggered Execution: Unix Shell Configuration Modification

title: "T1546.004 Event Triggered Execution: Unix Shell Configuration Modification"
id: e9cd1749-0ddc-4d3a-b496-0c8b32f046e5
description: 'Detect Shell Configuration Modification for Persistence via Event-Triggered Execution, covering /etc/profile, /etc/profile.d/, ~/.profile, ~/.bash_profile, ~/.bash_login, ~/.bashrc, and ~/.bash_logout - the full set of files this technique names as attacker targets. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TimeWindow, TargetUser, FilePathRegex.'
references:
  - https://attack.mitre.org/techniques/T1546/004
author: Shahrukh Khan
date: 2026-05-14
license: MIT
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.004

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: PATH
    nametype: NORMAL
    name|contains:
      - '/.bashrc'
      - '/.bash_profile'
      - '/etc/profile.d/'
      - '/etc/profile'
      - '/.profile'
      - '/.bash_login'
      - '/.bash_logout'

  condition: selection

falsepositives:
  - Legitimate shell-profile customization by users/admins; scope TargetUser to privileged accounts (root, service accounts) rather than ordinary user profiles for higher fidelity.

level: high

T1546.004 Event Triggered Execution: Unix Shell Configuration Modification

title: "T1546.004 Event Triggered Execution: Unix Shell Configuration Modification"
id: 8f45327c-3c04-4fea-b10b-ff86e3434a09
description: 'Detect Shell Configuration Modification for Persistence via Event-Triggered Execution. (Retargeted to the file_change macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: FileTargetList, PayloadEntropyThreshold, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1546/004
author: Shahrukh Khan
date: 2026-02-13
license: MIT
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.004

logsource:
  category: file_change
  product: macos

detection:
  selection:
    TargetFilename|endswith:
      - '.bash_profile'
      - '.bashrc'
      - '.zshrc'
      - '.zprofile'
      - '.profile'
  condition: selection

falsepositives:
  - Users and developer tools such as Homebrew and nvm legitimately append lines to shell profile files during normal setup, so this should be scoped to modifications containing base64-encoded content or network download commands rather than routine PATH edits.

level: medium

Related sub-techniques

Explore