Detectionmediumtest

Unix Shell Configuration Modification

Detect unix shell configuration modification. Adversaries may establish persistence through executing malicious commands triggered when a new shell is opened.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Peter Matkovski, IAICreated Mon Mar 06Updated Wed Mar 15a94cdd87-6c54-4678-a6cc-2814ffe5a13dlinux

Log Source

Linuxauditd

ProductLinux← raw: linux

Serviceauditd← raw: auditd

Detection Logic

detection:
    selection:
        type: 'PATH'
        name:
            - '/etc/shells'
            - '/etc/profile'
            - '/etc/profile.d/*'
            - '/etc/bash.bashrc'
            - '/etc/bashrc'
            - '/etc/zsh/zprofile'
            - '/etc/zsh/zshrc'
            - '/etc/zsh/zlogin'
            - '/etc/zsh/zlogout'
            - '/etc/csh.cshrc'
            - '/etc/csh.login'
            - '/root/.bashrc'
            - '/root/.bash_profile'
            - '/root/.profile'
            - '/root/.zshrc'
            - '/root/.zprofile'
            - '/home/*/.bashrc'
            - '/home/*/.zshrc'
            - '/home/*/.bash_profile'
            - '/home/*/.zprofile'
            - '/home/*/.profile'
            - '/home/*/.bash_login'
            - '/home/*/.bash_logout'
            - '/home/*/.zlogin'
            - '/home/*/.zlogout'
    condition: selection