Unix Trap Command Used for Persistence

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects the use of the 'trap' command with 'EXIT' in TCP traffic, which is a common technique used for persistence on Unix-like systems. Attackers can use the 'trap' command to execute arbitrary commands when a shell exits, ensuring their malicious code runs even after a session is closed.