H3XAOperational intelligence
Live analytical pictureEvidence before assessment
TypeTechnique
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

The trap command allows programs and shells to specify commands that will be executed upon receiving interrupt signals. A common situation is a script allowing for graceful termination and handling of common keyboard interrupts like ctrl+c and ctrl+d . Adversaries can use this to register code to be executed when the shell encounters specific interrupts either to gain execution or as a persistence mechanism. Trap commands are of the following format trap 'command list' signals where "command list" will be executed when "signals" are received.(Citation: Trap Manual)(Citation: Cyberciti Trap Statements)

1 recorded

Relationships

revoked-by
to Trap
Technique
3 external

References

mitre-attack
T1154
open
Trap Manual
https://ss64.com/bash/trap.html
open
Cyberciti Trap Statements
https://bash.cyberciti.biz/guide/Trap_statement
open