H3XAOperational intelligence
Live analytical pictureEvidence before assessment
TypeTechnique
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

Adversaries may establish persistence by executing malicious content triggered by an interrupt signal. The trap command allows programs and shells to specify commands that will be executed upon receiving interrupt signals. A common situation is a script allowing for graceful termination and handling of common keyboard interrupts like ctrl+c and ctrl+d . Adversaries can use this to register code to be executed when the shell encounters specific interrupts as a persistence mechanism. Trap commands are of the following format trap 'command list' signals where "command list" will be executed when "signals" are received.(Citation: Trap Manual)(Citation: Cyberciti Trap Statements)

2 recorded

Relationships

revoked-by
from Trap
Technique
subtechnique-ofTechnique
3 external

References

mitre-attack
T1546.005
open
Trap Manual
https://ss64.com/bash/trap.html
open
Cyberciti Trap Statements
https://bash.cyberciti.biz/guide/Trap_statement
open