Linux Shell Script Creation in /etc/profile.d/ for Persistence
Alerts on creation of .sh/.csh scripts in /etc/profile.d, a common place for persistence via shell startup.
FreeReviewedSigma · Low · v3
- Product
- linux
- Category
- file_event
- Author
- Joseliyo Sanchez, @Joseliyo_Jstnk (SigmaHQ), DRL 1.1
- Published
- 2023-06-02
- Updated
- 2026-07-31
What it detects
This rule flags file creation events where the target path includes /etc/profile.d/ and the created filename ends with .sh or .csh. Writing scripts into profile.d can enable persistent execution when shells initialize, which attackers may use to maintain footholds across sessions. The detection relies on Linux file event telemetry that records the created target filename/path.
Reporting behind it
- blogs.jpcert.or.jphttps://blogs.jpcert.or.jp/en/2023/05/gobrat.html
- jstnk9.github.iohttps://jstnk9.github.io/jstnk9/research/GobRAT-Malware/
- virustotal.comhttps://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection
- virustotal.comhttps://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/file_event/file_event_lnx_susp_shell_script_under_profile_directory.yml
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
suspicious-linux-shell-script-creation-under-etc-profile-d-13f08f54
title: Linux Shell Script Creation in /etc/profile.d/ for Persistence
id: 8d84af85-414f-4403-b772-5535d91bf4c8
status: test
description: This rule flags file creation events where the target path includes /etc/profile.d/ and the created filename ends with .sh or .csh. Writing scripts into profile.d can enable persistent execution when shells initialize, which attackers may use to maintain footholds across sessions. The detection relies on Linux file event telemetry that records the created target filename/path.
references:
- https://blogs.jpcert.or.jp/en/2023/05/gobrat.html
- https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/
- https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection
- https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/file_event/file_event_lnx_susp_shell_script_under_profile_directory.yml
author: Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule Team
date: 2023-06-02
tags:
- attack.persistence
logsource:
product: linux
category: file_event
detection:
selection:
TargetFilename|contains: /etc/profile.d/
TargetFilename|endswith:
- .csh
- .sh
condition: selection
falsepositives:
- Legitimate shell scripts in the "profile.d" directory could be common in your environment. Apply additional filter accordingly via "image", by adding specific filenames you "trust" or by correlating it with other events.
- Regular file creation during system update or software installation by the package manager
level: low
license: DRL-1.1
related:
- id: 13f08f54-e705-4498-91fd-cce9d9cee9f1
type: derived