Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1546.004sub-technique of T1546 Event Triggered Execution

Unix Shell Configuration Modification

Linux · macOSnothing on this site yetT1546.004 on attack.mitre.org

Adversaries may establish persistence through executing malicious commands triggered by a user’s shell. User Unix Shells execute several configuration scripts at different points throughout the session based on events. For example, when a user opens a command-line interface or remotely logs in (such as via SSH) a login shell is initiated.

MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

2

Checklists and playbooks to open while the alert is still live.

Playbook for this stage

Cloud account compromise

Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.

how MITRE says to see it

Detect Shell Configuration Modification for Persistence via Event-Triggered Execution

  • Detects modification of shell startup/logout scripts such as ~/.bashrc, ~/.bash_profile, or /etc/profile, followed by anomalous process execution or network connections upon interactive or remote shell login.
  • Correlates zsh shell configuration file changes (e.g., ~/.zshrc, ~/.zlogin, /etc/zprofile) with execution of unauthorized binaries or unexpected network activity triggered on Terminal.app launch.

what reduces it

  • M1022 Restrict File and Directory Permissions. Making these files immutable and only changeable by certain administrators will limit the ability for adversaries to easily create user level persistence.

the rest of T1546

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.