Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add "Trap" attack technique (T1154) #697

Closed
shreyamalviya opened this issue Jun 29, 2020 · 0 comments · Fixed by #698
Closed

Add "Trap" attack technique (T1154) #697

shreyamalviya opened this issue Jun 29, 2020 · 0 comments · Fixed by #698
Assignees
@shreyamalviya
Labels
Feature Issue that describes a new feature to be implemented.

Comments

@shreyamalviya
Copy link
Contributor

T1154

The trap command allows programs and shells to specify commands that will be executed upon receiving interrupt signals. Adversaries can use this to register code to be executed when the shell encounters specific interrupts.

Adding it as PBA:
- LINUX: use trap for SIGINT (ctrl+c), send signal, "untrap" the signal
- WINDOWS: not applicable

Mapping the technique to the ATT&CK matrix
@shreyamalviya shreyamalviya added Monkey Feature Issue that describes a new feature to be implemented. labels Jun 29, 2020
@shreyamalviya shreyamalviya self-assigned this Jun 29, 2020
@shreyamalviya shreyamalviya mentioned this issue Jun 29, 2020
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@shreyamalviya shreyamalviya

Labels
Feature Issue that describes a new feature to be implemented.
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Add T1154 attack technique (trap command) shreyamalviya/monkey
1 participant
@shreyamalviya