Suspicious Linux Shell Script Creation Under /etc/profile.d

title: Suspicious Linux Shell Script Creation Under /etc/profile.d
id: 8d84af85-414f-4403-b772-5535d91bf4c8
status: test
description: This rule flags file creation events where the target path contains /etc/profile.d/ and the filename ends with .sh or .csh. Attackers may use this location to establish persistence via shell startup scripts that run when a user initializes their environment. The detection relies on Linux file event telemetry that includes the created file path (TargetFilename).
references:
  - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html
  - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/
  - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection
  - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/file_event/file_event_lnx_susp_shell_script_under_profile_directory.yml
author: Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule Team
date: 2023-06-02
tags:
  - attack.persistence
logsource:
  product: linux
  category: file_event
detection:
  selection:
    TargetFilename|contains: /etc/profile.d/
    TargetFilename|endswith:
      - .csh
      - .sh
  condition: selection
falsepositives:
  - Legitimate shell scripts in the "profile.d" directory could be common in your environment. Apply additional filter accordingly via "image", by adding specific filenames you "trust" or by correlating it with other events.
  - Regular file creation during system update or software installation by the package manager
level: low
license: DRL-1.1
related:
  - id: 13f08f54-e705-4498-91fd-cce9d9cee9f1
    type: derived