Linux MOTD Script Persistence Technique

The '/etc/update-motd.d/' directory on Linux systems allows administrators to define scripts that generate the Message of the Day (MOTD), a text banner displayed to users upon successful remote login via SSH. Because these scripts are executed with the privileges of the system or the logging-in user, they represent a significant persistence vector. Attackers who gain sufficient privileges to modify files in this directory can insert malicious code that triggers during subsequent logins. This technique is particularly effective as it allows for the execution of payloads, lateral movement tools, or backdoors without requiring specialized rootkit software, making it a common choice for post-exploitation persistence. Defenders should treat any unauthorized file creation or modification in this directory as a high-fidelity indicator of a potential compromise.

Attack Chain

1. Attacker gains initial access or a foothold on the target Linux system through an exploit or credential theft.
2. Attacker performs local enumeration to identify the user's current shell and existing system configurations.
3. Attacker identifies the '/etc/update-motd.d/' directory as a target for persistence.
4. Attacker checks write permissions on the directory or existing scripts using standard tools like 'ls -l'.
5. Attacker creates a new script or modifies an existing script within '/etc/update-motd.d/' containing malicious commands (e.g., a reverse shell).
6. Attacker ensures the malicious file has the necessary execute permissions (e.g., 'chmod +x').
7. A legitimate user (often a system administrator) logs into the server via SSH.
8. The PAM (Pluggable Authentication Modules) framework executes the scripts in '/etc/update-motd.d/', triggering the attacker's payload.

Impact

Successful exploitation of this technique leads to persistent unauthorized access to the affected Linux system. This can be used to exfiltrate sensitive data, maintain long-term access for data theft, or provide a staging point for further lateral movement within the network. In scenarios where a root user logs in, the attacker can achieve persistent root-level execution.

Recommendation

• Deploy the provided Sigma rule to detect file modifications within '/etc/update-motd.d/'.
• Audit all current files within '/etc/update-motd.d/' to ensure they match approved system configuration and are signed or monitored for changes.
• Enable Sysmon for Linux or equivalent EDR telemetry (Event ID 11) to monitor file system activity in system directories.
• Implement file integrity monitoring (FIM) on '/etc/update-motd.d/' to alert on any unauthorized modifications.