Home/ MITRE Matrix/ Privilege Escalation/ T1546.004

T1546.004Unix Shell Configuration Modification

T1546.004 — Unix Shell Configuration Modification is a MITRE ATT&CK technique in the Privilege Escalation tactic. Clankerusecase tracks 8 detection use cases covering it and 4 threat-intel articles citing it.

Privilege EscalationPersistence

View on the matrix → Filter Detection Library MITRE official spec ↗

8Use cases

4Articles

0Sub-techniques

2Tactics

↑ Parent technique: T1546 · Event Triggered Execution

Use cases covering this technique (8)

[WEEKLY] Web-Facing Service Process Writes to RCE/Persistence Paths (Path-Traversal File-Write) Internal install · alerting DSΣPDDCS Linux Auditd Unix Shell Configuration Modification ESCU actions · alerting P Linux File Creation In Profile Directory ESCU actions · hunting P Linux Possible Append Command To Profile Config File ESCU actions · hunting P [LLM] keyv npm compromise: gh-token-monitor credential-persistence artifacts (macOS/Linux) Bespoke install · hunting DSΣPDDCS [LLM] Recurring cron/shell-rc execution of .tf_cache/hw_probe.pyc payload Bespoke install · alerting DSΣPDDCS [LLM] Atomic Arch persistence: systemd unit, cron or shell-rc written by AUR build / JS runtime Bespoke install · hunting DSΣPCS [LLM] Shell rc files (.bashrc/.zshrc) modified by package-install process — s1ngularity persistence/shutdown Bespoke install · hunting DSΣPCS

Articles citing this technique (4)

crit Inside the keyv npm Compromise: preinstall Malware, Trusted Provenance, and IDE Hooks art-139

crit Compromised PyPI Package: mrmustard 0.7.4 Steals SSH, Cloud, and Kubernetes Credentials art-193

crit 400+ AUR Packages Hijacked: What the “Atomic Arch” Campaign Means for Supply-Chain Security art-364

high 10,000 Open-Source Projects Now Secured by Harden-Runner Community-Tier: A Milestone Three Years in the Making art-672