- Home
- Techniques
- Enterprise
- Event Triggered Execution
- .bash_profile and .bashrc
Event Triggered Execution: .bash_profile and .bashrc
Other sub-techniques of Event Triggered Execution (15)
Adversaries may establish persistence by executing malicious content triggered by a user’s shell. ~/.bash_profile
and ~/.bashrc
are shell scripts that contain shell commands. These files are executed in a user's context when a new shell opens or when a user logs in so that their environment is set correctly.
~/.bash_profile
is executed for login shells and ~/.bashrc
is executed for interactive non-login shells. This means that when a user logs in (via username and password) to the console (either locally or remotely via something like SSH), the ~/.bash_profile
script is executed before the initial command prompt is returned to the user. After that, every time a new shell is opened, the ~/.bashrc
script is executed. This allows users more fine-grained control over when they want certain commands executed. These shell scripts are meant to be written to by the local user to configure their own environment.
The macOS Terminal.app is a little different in that it runs a login shell by default each time a new terminal window is opened, thus calling ~/.bash_profile
each time instead of ~/.bashrc
.
Adversaries may abuse these shell scripts by inserting arbitrary shell commands that may be used to execute other binaries to gain persistence. Every time the user logs in or opens a new shell, the modified ~/.bash_profile and/or ~/.bashrc scripts will be executed.[1]
Procedure Examples
Name | Description |
---|---|
HiddenWasp |
HiddenWasp installs reboot persistence by adding itself to |
Linux Rabbit |
Linux Rabbit maintains persistence on an infected machine through rc.local and .bashrc files. [3] |
Mitigations
Mitigation | Description |
---|---|
Restrict File and Directory Permissions |
Making these files immutable and only changeable by certain administrators will limit the ability for adversaries to easily create user level persistence. |
Detection
While users may customize their ~/.bashrc
and ~/.bash_profile
files , there are only certain types of commands that typically appear in these files. Monitor for abnormal commands such as execution of unknown programs, opening network sockets, or reaching out across the network when user profiles are loaded during the login process.