T1546.005 — Trap

Tactics: Privilege Escalation, Persistence · Platforms: macOS, Linux

Adversaries may establish persistence by executing malicious content triggered by an interrupt signal. The trap command allows programs and shells to specify commands that will be executed upon receiving interrupt signals. A common situation is a script allowing for graceful termination and…

Sub-technique of Event Triggered Execution (T1546).

Sigma detection rules (2)

T1546.005 Event Triggered Execution: Trap

title: "T1546.005 Event Triggered Execution: Trap"
id: ac905f74-a74b-4d77-8d3e-06d4de8ca906
description: 'Detection Strategy for Event Triggered Execution via Trap (T1546.005). Fixed: trap is a shell builtin and never appears as its own EXECVE record; the common real-world invocation is bash -c "trap ... signal", where the literal trap command lands in argv position a2 (a1 is the -c flag itself), not a1 as previously checked, so the rule now inspects a2 with a0/a1 constrained to an interpreter invoked via -c. Also corrected logsource to process_creation since the detection is EXECVE-based, not file_change. Tune using: TargetShellFilePath, SignalTrapName, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1546/005
author: Shahrukh Khan
date: 2026-06-07
modified: 2026-07-26
license: MIT
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.005

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/bash'
      - '/sh'
    a1: '-c'
    a2|contains: 'trap'

  condition: selection

falsepositives:
  - Legitimate shell scripts and one-liners commonly use trap for cleanup-on-exit handling; scope SignalTrapName to unusual signals (e.g. SIGUSR1/SIGUSR2 rather than the common EXIT/INT/TERM) for a stronger signal. Note that trap statements written inside a script file rather than passed via -c are not visible in EXECVE argv at all and require file-content or auditd watch-based detection instead.

level: medium

T1546.005 Event Triggered Execution: Trap

title: "T1546.005 Event Triggered Execution: Trap"
id: d69a754b-d047-418b-a3c1-3555f6a53103
description: 'Detection Strategy for Event Triggered Execution via Trap (T1546.005). (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: LoginShellConfigPaths, TrapCommandLengthThreshold, ParentProcessAnomalyThreshold.'
references:
  - https://attack.mitre.org/techniques/T1546/005
author: Shahrukh Khan
date: 2026-05-05
license: MIT
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.005

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/bash'
      - '/zsh'
  selection_args:
    CommandLine|contains: 'trap '
  selection_len:
    CommandLine|contains:
      - 'curl '
      - 'base64 '
  condition: selection and selection_args and selection_len

falsepositives:
  - Shell scripts legitimately use trap for cleanup on exit or interrupt signals, so this should be scoped to trap handlers that also contain network downloads or encoded payloads rather than simple cleanup logic.

level: medium

Related sub-techniques

Explore