Trap

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("bash", "sh", "zsh", "ksh", "dash")
| where ProcessCommandLine has "trap"
| where ProcessCommandLine has_any (
    "EXIT", "SIGTERM", "SIGHUP", "SIGINT", "ERR",
    "0", "1", "2", "15"  // signal numbers
  )
| extend TrapPayload = extract(@"trap\s+['\"]?(.+?)['\"]?\s+(EXIT|SIGTERM|SIGHUP|SIGINT|ERR|[0-9]+)", 1, ProcessCommandLine)
| extend SuspiciousTrap = ProcessCommandLine has_any (
    "curl", "wget", "nc", "ncat", "bash -i", "/dev/tcp",
    "python", "perl", "ruby", "base64", "eval"
  )
| where SuspiciousTrap
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         TrapPayload, SuspiciousTrap,
         InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc

index=syslog (sourcetype=linux_secure OR sourcetype=syslog)
| eval IsTrapCmd=if(match(_raw, "\\btrap\\b.*(EXIT|SIGTERM|SIGHUP|SIGINT|ERR|\\b[0-9]+\\b)"), 1, 0)
| eval HasSuspiciousPayload=if(match(_raw, "(curl|wget|nc\s|ncat|/dev/tcp|bash\s+-i|python[23]?\s+-c|perl\s+-e|base64|eval)"), 1, 0)
| where IsTrapCmd=1 AND HasSuspiciousPayload=1
| rex field=_raw "CMD\s*=\s*(?P<CMD>.+)"
| rex field=CMD "trap\s+(?P<TrapPayload>.+)"
| table _time, host, user, CMD, TrapPayload
| sort - _time

process where event.type == "start"
  and process.name in ("bash", "sh", "zsh", "ksh", "dash")
  and process.args : "trap"
  and process.command_line : ("*EXIT*", "*SIGTERM*", "*SIGHUP*", "*SIGINT*", "*ERR*")
  and process.command_line : ("*curl*", "*wget*", "*nc *", "*ncat*", "*bash -i*", "*/dev/tcp*", "*python*", "*perl*", "*ruby*", "*base64*", "*eval*")

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  logsourceid,
  LOGSOURCETYPENAME(logsourceid) AS log_source_type,
  sourceip,
  username,
  QIDNAME(qid) AS event_name,
  "UTF8"(payload) AS raw_payload
FROM events
WHERE
  devicetime > (CURRENT_TIMESTAMP - 86400000)
  AND LOWER("UTF8"(payload)) LIKE '%trap%'
  AND (
    "UTF8"(payload) LIKE '%EXIT%'
    OR "UTF8"(payload) LIKE '%SIGTERM%'
    OR "UTF8"(payload) LIKE '%SIGHUP%'
    OR "UTF8"(payload) LIKE '%SIGINT%'
    OR "UTF8"(payload) LIKE '%ERR%'
  )
  AND (
    LOWER("UTF8"(payload)) LIKE '%curl%'
    OR LOWER("UTF8"(payload)) LIKE '%wget%'
    OR LOWER("UTF8"(payload)) LIKE '%/dev/tcp%'
    OR LOWER("UTF8"(payload)) LIKE '%bash -i%'
    OR LOWER("UTF8"(payload)) LIKE '%base64%'
    OR LOWER("UTF8"(payload)) LIKE '%python%'
    OR LOWER("UTF8"(payload)) LIKE '%perl%'
    OR LOWER("UTF8"(payload)) LIKE '%ncat%'
    OR LOWER("UTF8"(payload)) LIKE '%eval%'
  )
  AND LOGSOURCETYPENAME(logsourceid) IN ('Linux OS', 'Linux Auth', 'Syslog')
ORDER BY devicetime DESC

_sourceCategory=linux* OR _sourceCategory=syslog*
| where (%"message" matches /\btrap\b/ or _raw matches /\btrap\b/)
| where _raw matches /(?i)(EXIT|SIGTERM|SIGHUP|SIGINT|\bERR\b)/
| where _raw matches /(?i)(curl|wget|\bnc\s|ncat|\/dev\/tcp|bash\s+-i|python[23]?\s+-c|perl\s+-e|base64|\beval\b)/
| parse regex field=_raw "CMD\s*=\s*(?P<command_line>.+)" nodrop
| parse regex field=command_line "trap\s+(?P<trap_payload>.+?)\s+(?:EXIT|SIGTERM|SIGHUP|SIGINT|ERR|\d+)" nodrop
| fields _messageTime, _sourceHost, _sourceCategory, command_line, trap_payload
| sort by _messageTime desc

rule t1546_005_trap_persistence {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects T1546.005 - Trap command abuse for persistence via signal handlers containing suspicious payloads"
    mitre_attack_tactic = "Persistence"
    mitre_attack_technique = "T1546.005"
    severity = "HIGH"
    confidence = "HIGH"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.process.file.full_path = /\/(bash|sh|zsh|ksh|dash)$/
    $e.target.process.command_line = /\btrap\b/
    $e.target.process.command_line = /(EXIT|SIGTERM|SIGHUP|SIGINT|\bERR\b)/
    $e.target.process.command_line = /(curl|wget|\bnc\s|ncat|\/dev\/tcp|bash\s+-i|python[23]?\s+-c|perl\s+-e|base64|\beval\b)/i

  condition:
    $e
}

#event_simpleName=ProcessRollup2
| ImageFileName = /\/(bash|sh|zsh|ksh|dash)$/i
| CommandLine = /\btrap\b/i
| CommandLine = /(EXIT|SIGTERM|SIGHUP|SIGINT|\bERR\b)/
| CommandLine = /(curl|wget|\bnc\s|ncat|\/dev\/tcp|bash\s+-i|python[23]?\s+-c|perl\s+-e|base64|\beval\b)/i
| regex(field=CommandLine, regex="trap\\s+(?P<trap_payload>.+?)\\s+(?:EXIT|SIGTERM|SIGHUP|SIGINT|ERR|[0-9]+)", strict=false)
| table([@timestamp, ComputerName, UserName, ImageFileName, CommandLine, trap_payload, ParentBaseFileName])
| sort(@timestamp, order=desc)