Trap abuse (MITRE ATT&CK T1546.005) is an event triggered execution technique on Linux and macOS. The shell trap command lets a script run a set of commands when it receives an interrupt signal. Scripts use it for tidy shutdowns, such as handling Ctrl+C.
How attackers use it
MITRE describes the same feature turned into persistence. An adversary registers code with trap so it runs when the shell sees specific signals. The format is trap 'command list' signals, where the command list runs when those signals arrive.
The trigger is ordinary user activity at a terminal. Nothing needs to run on a schedule, and the line itself looks like routine shell scripting.
How to detect it
MITRE's detection strategy points at the places a trap line has to live to survive:
- Modifications to shell startup scripts such as
.bashrcand.profile(Linux) or.zprofile,.bash_profileand.zshrc(macOS) that contain trap commands. - Unexpected child processes that start when a terminal signal such as SIGINT arrives.
- On macOS, Unified Logs and EDR telemetry that tie shell command parsing to an odd process tree.
Link file changes to user session activity. A trap line that appeared with no matching admin change is the signal.
How to reduce the risk
MITRE lists no specific mitigations for this technique. The practical steps follow from the detection advice: monitor changes to shell startup files, limit write access to them, and review them after any suspected compromise.
Quick check
Where would you look first for a malicious trap persistence line?
In shell startup files such as .bashrc, .profile, .bash_profile and .zshrc, then at what process starts when a signal is sent to the shell.
