Abuse of POSIX Shell Trap Command for Persistence and Privilege Escalation

Adversaries can abuse the POSIX shell 'trap' built-in command to bind arbitrary commands to interrupt signals such as SIGINT, SIGHUP, or SIGTERM. This technique enables attackers to trigger malicious payloads automatically when a process receives a specific signal, or when a user interacts with a shell (e.g., pressing Ctrl+C). By embedding these traps within shell startup files (.bashrc, .zshrc), system initialization scripts, or service unit files, attackers establish persistence or execute actions with elevated privileges.

This method is particularly effective because the malicious code executes silently without requiring the user to invoke a specific binary, making it a subtle technique for achieving persistence or triggering privilege escalation payloads, such as modifying /etc/sudoers or deploying reverse shells. Defenders must distinguish between this malicious signal binding and legitimate administrative cleanup tasks, which also frequently utilize trap handlers to perform graceful service shutdowns.

Impact

Successful exploitation allows attackers to maintain stealthy persistence and escalate privileges on compromised Linux and macOS systems. Impact includes unauthorized modification of system configuration files, deployment of setuid helpers for long-term access, and the establishment of persistent reverse shells. Because the trigger is signal-based, the malicious activity may occur sporadically or only when specific administrative actions are performed, complicating detection and attribution.

Recommendation

• Deploy the provided Sigma rule to monitor for suspicious process execution involving the 'trap' command and signal-related arguments.
• Implement file integrity monitoring on shell configuration files, including .bashrc, .zshrc, /etc/profile, and /etc/profile.d, to detect unauthorized trap definitions.
• Audit systemd unit files and cron wrappers for trap commands bound to privileged operations or shell execution.
• Restrict write access to system-wide initialization scripts and service unit configurations to privileged accounts only.
• Establish alerting for modifications to /etc/sudoers and critical PAM configuration files.