Linux Auditd: Unix Shell Configuration File Modification
Alerts when shell startup or login configuration files (system or user) are modified on Linux.
FreeReviewedSigma · Medium · v3
- Product
- linux
- Service
- auditd
- Author
- Peter Matkovski, IAI (SigmaHQ), DRL 1.1
- Published
- 2023-03-06
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags modifications involving common Unix shell initialization and profile files, including system-wide and user-specific paths. Attackers may abuse these files to persist by triggering malicious commands when a shell session starts. It relies on auditd events that report file path values matching the listed shell configuration locations.
Reporting behind it
- objective-see.orghttps://objective-see.org/blog/blog_0x68.html
- web.archive.orghttps://web.archive.org/web/20221204161143/https://www.glitch-cat.com/p/green-lambert-and-attack
- anomali.comhttps://www.anomali.com/blog/pulling-linux-rabbit-rabbot-malware-out-of-a-hat
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/path/lnx_auditd_unix_shell_configuration_modification.yml
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
linux-auditd-alerts-on-unix-shell-configuration-file-modifications-a94cdd87
title: "Linux Auditd: Unix Shell Configuration File Modification"
id: e7f55a6e-4d81-4e7a-9a18-02424952d72c
related:
- id: e74e15cc-c4b6-4c80-b7eb-dfe49feb7fe9
type: obsolete
- id: a94cdd87-6c54-4678-a6cc-2814ffe5a13d
type: derived
status: test
description: This rule flags modifications involving common Unix shell initialization and profile files, including system-wide and user-specific paths. Attackers may abuse these files to persist by triggering malicious commands when a shell session starts. It relies on auditd events that report file path values matching the listed shell configuration locations.
references:
- https://objective-see.org/blog/blog_0x68.html
- https://web.archive.org/web/20221204161143/https://www.glitch-cat.com/p/green-lambert-and-attack
- https://www.anomali.com/blog/pulling-linux-rabbit-rabbot-malware-out-of-a-hat
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/path/lnx_auditd_unix_shell_configuration_modification.yml
author: Peter Matkovski, IAI, Huntrule Team
date: 2023-03-06
modified: 2023-03-15
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1546.004
logsource:
product: linux
service: auditd
detection:
selection:
type: PATH
name:
- /etc/shells
- /etc/profile
- /etc/profile.d/*
- /etc/bash.bashrc
- /etc/bashrc
- /etc/zsh/zprofile
- /etc/zsh/zshrc
- /etc/zsh/zlogin
- /etc/zsh/zlogout
- /etc/csh.cshrc
- /etc/csh.login
- /root/.bashrc
- /root/.bash_profile
- /root/.profile
- /root/.zshrc
- /root/.zprofile
- /home/*/.bashrc
- /home/*/.zshrc
- /home/*/.bash_profile
- /home/*/.zprofile
- /home/*/.profile
- /home/*/.bash_login
- /home/*/.bash_logout
- /home/*/.zlogin
- /home/*/.zlogout
condition: selection
falsepositives:
- Admin or User activity are expected to generate some false positives
level: medium
license: DRL-1.1