Adversaries may establish persistence by executing malicious content triggered by an interrupt signal. The trap command allows programs and shells to specify commands that will be executed upon receiving interrupt signals. A common situation is a script allowing for graceful termination and handling of common keyboard interrupts like ctrl+c and ctrl+d.
Adversaries can use this to register code to be executed when the shell encounters specific interrupts as a persistence mechanism. Trap commands are of the following format trap 'command list' signals where "command list" will be executed when "signals" are received.[1][2]
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0017 | Command | Command Execution |
Monitor executed commands and arguments that may establish persistence by executing malicious content triggered by an interrupt signal. |
| DS0022 | File | File Creation |
Monitor for newly constructed files that may establish persistence by executing malicious content triggered by an interrupt signal. |
| File Modification |
Monitor for changes made to files that may establish persistence by executing malicious content triggered by an interrupt signal. |
||
| DS0009 | Process | Process Creation |
Monitor newly executed processes that may establish persistence by executing malicious content triggered by an interrupt signal. |