{'created': '2017-12-14T16:46:06.044Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': 'Adversaries may establish persistence through executing '
                'malicious commands triggered by a user’s shell. User shells '
                'execute several configuration scripts at different points '
                'throughout the session based on events. For example, when a '
                'user opens a command line interface or remotely logs in (such '
                'as SSH) a login shell is initiated. The login shell executes '
                'scripts from the system (/etc) and the user’s home directory '
                '(~/) to configure the environment. All login shells on a '
                'system use <code>/etc/profile</code> when initiated. These '
                'configuration scripts run at the permission level of their '
                'directory and are often used to set environment variables, '
                'create aliases, and customize the user’s environment. When '
                'the shell exits or terminates, additional shell scripts are '
                'executed to ensure the shell exits appropriately. \n'
                '\n'
                'Adversaries may attempt to establish persistence by inserting '
                'commands into scripts automatically executed by shells. Using '
                'bash as an example, the default shell for most GNU/Linux '
                'systems, adversaries may add commands that launch malicious '
                'binaries into the <code>/etc/profile</code> and '
                '<code>/etc/profile.d</code> files (Citation: '
                'intezer-kaiji-malware). These files require root permissions '
                'and are executed each time any shell on a system launches. '
                'For user level permissions, adversaries can insert malicious '
                'commands into <code>~/.bash_profile</code>, '
                '<code>~/.bash_login</code>, or <code>~/.profile</code> '
                '(Rocke) which are sourced when a user opens a command line '
                'interface or connects remotely. Adversaries often use '
                '~/.bash_profile since the system only executes the first file '
                'that exists in the listed order. Adversaries have also '
                'leveraged the <code>~/.bashrc</code> file (Tsunami, Rocke, '
                'Linux Rabbit, Magento) which is additionally executed if the '
                'connection is established remotely or an additional '
                'interactive shell is opened, such as a new tab in the command '
                'line interface. Some malware targets the termination of a '
                'program to trigger execution (Cannon), adversaries can use '
                'the <code>~/.bash_logout</code> file to execute malicious '
                'commands at the end of a session(Pearl_shellbot). \n'
                '\n'
                'For macOS, the functionality of this technique is similar but '
                'leverages zsh, the default shell for macOS 10.15+. When the '
                'Terminal.app is opened, the application launches a zsh login '
                'shell and a zsh interactive shell. The login shell configures '
                'the system environment using <code>/etc/profile</code>, '
                '<code>/etc/zshenv</code>, <code>/etc/zprofile</code>, and '
                '<code>/etc/zlogin</code>. The login shell then configures the '
                'user environment with <code>~/.zprofile</code> and '
                '<code>~/.zlogin</code>. The interactive shell uses the '
                '<code>~/.zshrc<code> to configure the user environment. Upon '
                'exiting, <code>/etc/zlogout</code> and '
                '<code>~/.zlogout</code> are executed. For legacy programs, '
                'macOS executes <code>/etc/bashrc</code> on startup.',
 'external_references': [{'external_id': 'T1156',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/techniques/T1156'},
                         {'description': 'Paul Litvak. (2020, May 4). Kaiji: '
                                         'New Chinese Linux malware turning to '
                                         'Golang. Retrieved December 17, 2020.',
                          'source_name': 'intezer-kaiji-malware',
                          'url': 'https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/'}],
 'id': 'attack-pattern--01df3350-ce05-4bdf-bdf8-0a919a66d4a8',
 'kill_chain_phases': [{'kill_chain_name': 'mitre-attack',
                        'phase_name': 'persistence'}],
 'modified': '2025-10-24T17:48:19.775Z',
 'name': 'Malicious Shell Modification',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'revoked': True,
 'spec_version': '2.1',
 'type': 'attack-pattern',
 'x_mitre_attack_spec_version': '3.2.0',
 'x_mitre_contributors': ['Robert Wilson',
                          'Joe Gervais',
                          'Tony Lambert, Red Canary'],
 'x_mitre_deprecated': False,
 'x_mitre_detection': '',
 'x_mitre_domains': ['enterprise-attack'],
 'x_mitre_is_subtechnique': False,
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_platforms': ['Linux', 'macOS'],
 'x_mitre_version': '1.2'}