Operating systems use signals to tell processes to pause or stop. MITRE T1564.011, Ignore Process Interrupts, covers adversaries who launch commands that ignore those signals so they keep running. It is a stealth technique that applies to Linux, macOS and Windows.
How attackers use it
Command interpreters include commands and flags that ignore hangups, such as when a user logs off. MITRE names nohup and PowerShell with -ErrorAction SilentlyContinue as examples. A process started this way can survive events that would normally end it, like a logout or the loss of its command and control connection.
The same signals are what defenders and defensive tools use to pause or terminate a process, so ignoring them also makes cleanup harder.
MITRE is explicit that this is not persistence. Unlike Trap, the process will not be started again once it actually ends.
How to detect it
MITRE's analytics focus on command lines and on processes that outlive their session:
- Linux and macOS:
nohup, disowned jobs or an&suffix, correlated with a process still running after the parent terminal exits. On macOS, also look for AppleScript constructs with persistent execution. - Windows: PowerShell or scripts using parameters that suppress errors or ignore interrupts, where behavior continues despite the suppressed errors.
A process that survives its user's logout is a useful thing to review, especially when it was not started by a service manager.
How to reduce the risk
MITRE lists no dedicated mitigation. Since nohup and similar flags are legitimate, the practical control is visibility: log command lines, and review long-lived processes that belong to ended sessions.
Quick check
Does ignoring interrupts give an attacker persistence?
No. MITRE notes that once the process is actually terminated it will not be re-invoked, so this only helps it survive session events.
