Unix Shell Configuration Modification

{
  "id": "ATTACK:enterprise:T1546.004",
  "title": "Unix Shell Configuration Modification",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1546/004",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--b63a34e8-0a61-4c97-a23b-bf8a2ed812e2",
  "external_id": "T1546.004",
  "domain": "enterprise",
  "created": "2020-01-24T14:13:45.936Z",
  "modified": "2026-05-12T15:12:00.709Z",
  "version": "2.2",
  "aliases": [

  ],
  "tactics": [
    "privilege-escalation",
    "persistence"
  ],
  "source_references": [
    {
      "source_name": "anomali-linux-rabbit",
      "url": "https://www.anomali.com/blog/pulling-linux-rabbit-rabbot-malware-out-of-a-hat"
    },
    {
      "source_name": "anomali-rocke-tactics",
      "url": "https://www.anomali.com/blog/illicit-cryptomining-threat-actor-rocke-changes-tactics-now-more-difficult-to-detect"
    },
    {
      "source_name": "Linux manual bash invocation",
      "url": "https://wiki.archlinux.org/index.php/Bash#Invocation"
    },
    {
      "source_name": "ScriptingOSX zsh",
      "url": "https://scriptingosx.com/2019/06/moving-to-zsh-part-2-configuration-files/"
    },
    {
      "source_name": "bencane blog bashrc",
      "url": "https://web.archive.org/web/20220316014323/http://bencane.com/2013/09/16/understanding-a-little-more-about-etcprofile-and-etcbashrc/"
    },
    {
      "source_name": "macOS MS office sandbox escape",
      "url": "https://cedowens.medium.com/macos-ms-office-sandbox-brain-dump-4509b5fed49a"
    },
    {
      "source_name": "Magento",
      "url": "https://blog.sucuri.net/2018/05/shell-logins-as-a-magento-reinfection-vector.html"
    },
    {
      "source_name": "Tsunami",
      "url": "https://unit42.paloaltonetworks.com/unit42-new-iotlinux-malware-targets-dvrs-forms-botnet/"
    },
    {
      "source_name": "PersistentJXA_leopitt",
      "url": "https://posts.specterops.io/persistent-jxa-66e1c3cd1cf5"
    },
    {
      "source_name": "code_persistence_zsh",
      "url": "https://github.com/D00MFist/PersistentJXA/blob/master/BashProfilePersist.js"
    },
    {
      "source_name": "ESF_filemonitor",
      "url": "https://objective-see.com/blog/blog_0x48.html"
    },
    {
      "source_name": "intezer-kaiji-malware",
      "url": "https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/"
    }
  ]
}