Skip to content

Hide Navigation Hide TOC

Trap - T1154 (b53dbcc6-147d-48bb-9df4-bcb8bb808ff6)

The trap command allows programs and shells to specify commands that will be executed upon receiving interrupt signals. A common situation is a script allowing for graceful termination and handling of common keyboard interrupts like ctrl+c and ctrl+d. Adversaries can use this to register code to be executed when the shell encounters specific interrupts either to gain execution or as a persistence mechanism. Trap commands are of the following format trap 'command list' signals where "command list" will be executed when "signals" are received.(Citation: Trap Manual)(Citation: Cyberciti Trap Statements)

Cluster A Galaxy A Cluster B Galaxy B Level
Trap - T1154 (b53dbcc6-147d-48bb-9df4-bcb8bb808ff6) Attack Pattern Trap - T1546.005 (63220765-d418-44de-8fae-694b3912317d) Attack Pattern 1
Event Triggered Execution - T1546 (b6301b64-ef57-4cce-bb0b-77026f14a8db) Attack Pattern Trap - T1546.005 (63220765-d418-44de-8fae-694b3912317d) Attack Pattern 2