T1156.md

T1156 - .bash_profile and .bashrc

Description from ATT&CK

~/.bash_profile and ~/.bashrc are executed in a user's context when a new shell opens or when a user logs in so that their environment is set correctly. ~/.bash_profile is executed for login shells and ~/.bashrc is executed for interactive non-login shells. This means that when a user logs in (via username and password) to the console (either locally or remotely via something like SSH), ~/.bash_profile is executed before the initial command prompt is returned to the user. After that, every time a new shell is opened, ~/.bashrc is executed. This allows users more fine grained control over when they want certain commands executed.

Mac's Terminal.app is a little different in that it runs a login shell by default each time a new terminal window is opened, thus calling /.bash_profile each time instead of /.bashrc.

These files are meant to be written to by the local user to configure their own environment; however, adversaries can also insert code into these files to gain persistence each time a user logs in or opens a new shell (Citation: amnesia malware).

Detection: While users may customize their /.bashrc and /.bash_profile files , there are only certain types of commands that typically appear in these files. Monitor for abnormal commands such as execution of unknown programs, opening network sockets, or reaching out across the network when user profiles are loaded during the login process.

Platforms: Linux, macOS

Data Sources: File monitoring, Process Monitoring, Process command-line parameters, Process use of network

Permissions Required: User, Administrator

Atomic Tests

• Atomic Test #1 - .bash_profile and .bashrc

Atomic Test #1 - .bash_profile and .bashrc

xxx

Supported Platforms: macOS, Linux

Inputs

Name	Description	Type	Default Value
script	path to script	path	/path/to/script.py

Run it with sh!

echo "#{script}" >> ~/.bash_profile
echo "#{script}" >> ~/.bashrc