huntrule

Linux Auditd: Unix Shell Configuration File Modification

Alerts when shell startup or login configuration files (system or user) are modified on Linux.

FreeReviewedSigma · Medium · v3
Product
linux
Service
auditd
Author
Peter Matkovski, IAI (SigmaHQ), DRL 1.1
Published
2023-03-06
Updated
2026-07-31
AnalysisDetection
title: "Linux Auditd: Unix Shell Configuration File Modification"
id: e7f55a6e-4d81-4e7a-9a18-02424952d72c
related:
  - id: e74e15cc-c4b6-4c80-b7eb-dfe49feb7fe9
    type: obsolete
  - id: a94cdd87-6c54-4678-a6cc-2814ffe5a13d
    type: derived
status: test
description: This rule flags modifications involving common Unix shell initialization and profile files, including system-wide and user-specific paths. Attackers may abuse these files to persist by triggering malicious commands when a shell session starts. It relies on auditd events that report file path values matching the listed shell configuration locations.
references:
  - https://objective-see.org/blog/blog_0x68.html
  - https://web.archive.org/web/20221204161143/https://www.glitch-cat.com/p/green-lambert-and-attack
  - https://www.anomali.com/blog/pulling-linux-rabbit-rabbot-malware-out-of-a-hat
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/path/lnx_auditd_unix_shell_configuration_modification.yml
author: Peter Matkovski, IAI, Huntrule Team
date: 2023-03-06
modified: 2023-03-15
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.004
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: PATH
    name:
      - /etc/shells
      - /etc/profile
      - /etc/profile.d/*
      - /etc/bash.bashrc
      - /etc/bashrc
      - /etc/zsh/zprofile
      - /etc/zsh/zshrc
      - /etc/zsh/zlogin
      - /etc/zsh/zlogout
      - /etc/csh.cshrc
      - /etc/csh.login
      - /root/.bashrc
      - /root/.bash_profile
      - /root/.profile
      - /root/.zshrc
      - /root/.zprofile
      - /home/*/.bashrc
      - /home/*/.zshrc
      - /home/*/.bash_profile
      - /home/*/.zprofile
      - /home/*/.profile
      - /home/*/.bash_login
      - /home/*/.bash_logout
      - /home/*/.zlogin
      - /home/*/.zlogout
  condition: selection
falsepositives:
  - Admin or User activity are expected to generate some false positives
level: medium
license: DRL-1.1