Unix Shell Configuration File Modification

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•3•0•39

Detects modifications to critical Unix shell configuration files. Adversaries may modify these files to establish persistence or elevate privileges by executing malicious commands when a new shell is opened or a user logs in.