Shell startup file access
A tool call refers to a recognized Unix shell startup or logout file.
Why it is risky
Section titled “Why it is risky”Changes to these files can cause commands to run automatically in later shells. An attacker can make a one-time instruction recur after the original agent task ends.
Example
Section titled “Example”An agent adds an unfamiliar upload command to a shell profile so it runs when a new shell starts.
This is a fictional example, not an event from a customer.
What Omnodex Detects
Section titled “What Omnodex Detects”The rule matches selected profile paths such as .bashrc, .zshrc, and .profile. Its current path condition does not require a write.
| Rule ID | Event category | Tier | Base severity |
|---|---|---|---|
RULE_PERSISTENCE_SHELL_STARTUP | persistence | Community | HIGH |
Base severity is the rule default. A finding involving content saved for later execution may have a lower severity. Your loaded rule version and event details determine the finding you see.
What to check next
Section titled “What to check next”Check whether the call changed the file. Review added commands, their source, destinations, and permissions before opening another shell.
False positives
Section titled “False positives”Reading a profile to diagnose PATH or making an approved shell customization can match. Different shells load different files in different circumstances.
False negatives
Section titled “False negatives”Unlisted shell profiles, scheduled tasks, service configuration, unsupported path fields, and hidden subprocess writes may be missed.
Technical details
Section titled “Technical details”A path match does not prove persistence was installed. Automatic execution depends on shell behavior and the actual file content.
A finding describes a pattern in captured activity. Review the original call, its result, and the task context before concluding that harm occurred. Absence of a finding does not establish that an operation is safe.
References
Section titled “References”MITRE ATT&CK documents Unix shell configuration modification as an automatic-execution technique. This describes the risk mechanism rather than a diagnosis of this event. Read MITRE ATT&CK T1546.004.