T1154.md

T1154 - Trap

Description from ATT&CK

The trap command allows programs and shells to specify commands that will be executed upon receiving interrupt signals. A common situation is a script allowing for graceful termination and handling of common keyboard interrupts like ctrl+c and ctrl+d. Adversaries can use this to register code to be executed when the shell encounters specific interrupts either to gain execution or as a persistence mechanism. Trap commands are of the following format trap 'command list' signals where "command list" will be executed when "signals" are received.(Citation: Trap Manual)(Citation: Cyberciti Trap Statements)

Atomic Tests

• Atomic Test #1 - Trap

Atomic Test #1 - Trap

After exiting the shell, the script will download and execute.

After sending a keyboard interrupt (CTRL+C) the script will download and execute.

Supported Platforms: macOS, Linux

Attack Commands: Run with sh!

trap "nohup sh $PathToAtomicsFolder/T1154/src/echo-art-fish.sh | bash" EXIT
exit
trap "nohup sh $PathToAtomicsFolder/T1154/src/echo-art-fish.sh | bash" SIGINt