Shell Configuration Modification (EDR Graph)
This rule watches for changes to files like .bashrc, .bash_profile, .zshrc, or authorized_keys. Attackers modify these files to run their own commands automatically or to add their own SSH key, so they can get back in later.
How the attack works
An attacker who has already gained some access to a machine writes to a shell profile file (such as .bashrc or .bash_profile) or appends an entry to authorized_keys. A change to a shell profile means malicious commands run every time a user opens a shell or logs in. A change to authorized_keys lets the attacker log in over SSH using their own key, without needing a password. The rule watches file-write activity captured at the EDR/syscall level and checks every 30 seconds for writes touching these specific files.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 1e785c77-6d77-5c79-ae24-6a389f9ef7f1-p
- Severity
- High
Why it matters
If missed, an attacker keeps automatic, repeatable access to the machine even after the original entry point is closed, and can quietly re-run their tools every time someone logs in.
What you can do
- →Review .bashrc, .bash_profile, .zshrc, .profile, and authorized_keys on affected hosts for unexpected entries.
- →Restrict write permissions on shell profile files and the .ssh directory to the owning user only.
- →Keep a known-good baseline of authorized_keys and alert on any deviation.
- →Rotate SSH keys and review recent logins if an unauthorized authorized_keys entry is found.