MITRE ATT&CK / T1546.005
T1546.005
Trap
Description
Adversaries may establish persistence by executing malicious content triggered by an interrupt signal. The <code>trap</code> command allows programs and shells to specify commands that will be executed upon receiving interrupt signals. A common situation is a script allowing for graceful termination and handling of common keyboard interrupts like <code>ctrl+c</code> and <code>ctrl+d</code>.Adversaries can use this to register code to be executed when the shell encounters specific interrupts as a persistence mechanism. Trap commands are of the following format <code>trap 'command list' signals</code> where "command list" will be executed when "signals" are received.(Citation: Trap Manual)(Citation: Cyberciti Trap Statements)
Platforms
Use our free MITRE ATT&CK lookup tool, or browse the full ATT&CK matrix.
Our coverage
- VoidStealer Bypasses Chrome App-Bound Encryption Without Code Injection or Privilege Escalation
- PCPJack Cloud Worm Evicts TeamPCP and Steals 40+ Credential Types at Scale
- SHA-1 Algorithm Explained: How It Works, Step by Step
- FEMITBOT: Telegram Mini Apps Used for Crypto Scams and Android Malware Delivery
- What is information Warfare? Explanation and Types
Source: MITRE ATT&CK Enterprise matrix. View on attack.mitre.org →