T1564.011 — Ignore Process Interrupts

Tactic: Stealth · Platforms: Linux, macOS, Windows

Adversaries may evade defensive mechanisms by executing commands that hide from process interrupt signals. Many operating systems use signals to deliver messages to control process behavior. Command interpreters often include specific commands/flags that ignore errors and other hangups, such as…

Sub-technique of Hide Artifacts (T1564).

Sigma detection rules (3)

T1564.011 Hide Artifacts: Ignore Process Interrupts

title: "T1564.011 Hide Artifacts: Ignore Process Interrupts"
id: f14d567b-69ad-4cf4-9407-ee1f26518343
description: 'Detects PowerShell invoked with -ErrorAction SilentlyContinue combined with a hidden/no-profile window, consistent with a command intended to keep running silently through interrupts/hangups (e.g. session logoff) rather than the original telemetry, which matched Defender-exclusion tampering (T1562.001). Tune using: MonitoredCmdlets, ErrorActionThreshold.'
references:
  - https://attack.mitre.org/techniques/T1564/011
author: Shahrukh Khan
date: 2026-01-22
license: MIT
tags:
  - attack.stealth
  - attack.t1564.011

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains: '-ErrorAction SilentlyContinue'
  selection_hidden:
    CommandLine|contains:
      - '-WindowStyle Hidden'
      - '-W Hidden'
      - '-NoProfile'

  condition: selection and selection_hidden

falsepositives:
  - Legitimate scheduled-task/automation scripts that combine error suppression with hidden or no-profile execution.

level: medium

T1564.011 Hide Artifacts: Ignore Process Interrupts

title: "T1564.011 Hide Artifacts: Ignore Process Interrupts"
id: 98d27604-88c8-43b9-bfc6-3f03636b6bea
description: 'Detection Strategy for Ignore Process Interrupts. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: IgnoredSignals, ProcessLifetimeThreshold.'
references:
  - https://attack.mitre.org/techniques/T1564/011
author: Shahrukh Khan
date: 2026-05-29
license: MIT
tags:
  - attack.stealth
  - attack.t1564.011

logsource:
  category: process_creation
  product: linux

detection:
  selection_nohup:
    type: EXECVE
    a0|endswith: '/nohup'
  selection_setsid:
    type: EXECVE
    a0|endswith: '/setsid'
  selection_disown:
    type: EXECVE
    a0|endswith: '/bash'
    a1|contains: 'disown'

  condition: 1 of selection*

falsepositives:
  - nohup/setsid are extremely common for legitimate long-running background jobs (builds, backups); process-lifetime/tag correlation (tune ProcessLifetimeThreshold) is required to isolate malicious persistence use.

level: low

T1564.011 Hide Artifacts: Ignore Process Interrupts

title: "T1564.011 Hide Artifacts: Ignore Process Interrupts"
id: 77a5b972-062e-40bf-a2b1-b49aeb02522c
description: 'Detection Strategy for Ignore Process Interrupts. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: WatchedShells, PersistenceCorrelationWindow.'
references:
  - https://attack.mitre.org/techniques/T1564/011
author: Shahrukh Khan
date: 2026-01-09
license: MIT
tags:
  - attack.stealth
  - attack.t1564.011

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/bash'
      - '/zsh'
    CommandLine|contains|all:
      - 'trap'
      - 'SIGINT'
  selection2:
    Image|endswith: '/nohup'

  condition: 1 of selection*

falsepositives:
  - Long-running legitimate maintenance or backup shell scripts that intentionally trap SIGINT to finish a critical section, and normal use of nohup to keep a job alive after logout.

level: low

Related sub-techniques

Explore