Techniques › T1546.004 › AN0060
AN0060 Analytic 0060
macOS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Correlates zsh shell configuration file changes (e.g., ~/.zshrc, ~/.zlogin, /etc/zprofile) with execution of unauthorized binaries or unexpected network activity triggered on Terminal.app launch.</p>
- Detects
- T1546.004 Unix Shell Configuration Modification
- Part of
- DET0020 Detect Shell Configuration Modification for Persistence via Event-Triggered Execution
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| macos:unifiedlog | launch of Terminal.app or shell with non-standard environment setup | DC0032 Process Creation |
| macos:endpointsecurity | ES_EVENT_TYPE_NOTIFY_WRITE, targeting .zshrc, .zlogin, .zprofile | DC0061 File Modification |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
FileTargetList | Customizable list of shell config files considered sensitive for detection. |
PayloadEntropyThreshold | Used to distinguish benign from potentially obfuscated commands written to config files. |
UserContext | Scoping based on user login class, e.g., administrative vs standard users. |