# Shell Configuration Modification (EDR Graph)

- **Severity:** High
- **Signature ID:** `1e785c77-6d77-5c79-ae24-6a389f9ef7f1-p`
- **MITRE ATLAS:** AML.T0053 (AI Agent Tool Invocation), AML.T0081 (Modify AI Agent Configuration)
- **OWASP:** ASI07 (Unsafe Autonomous Code Execution), ASI01 (Agent Authorization and Control Hijacking)

## Summary

This rule watches for changes to files like .bashrc, .bash_profile, .zshrc, or authorized_keys. Attackers modify these files to run their own commands automatically or to add their own SSH key, so they can get back in later.

## How the attack works

An attacker who has already gained some access to a machine writes to a shell profile file (such as .bashrc or .bash_profile) or appends an entry to authorized_keys. A change to a shell profile means malicious commands run every time a user opens a shell or logs in. A change to authorized_keys lets the attacker log in over SSH using their own key, without needing a password. The rule watches file-write activity captured at the EDR/syscall level and checks every 30 seconds for writes touching these specific files.

## Why it matters

If missed, an attacker keeps automatic, repeatable access to the machine even after the original entry point is closed, and can quietly re-run their tools every time someone logs in.

## What you can do

- Review .bashrc, .bash_profile, .zshrc, .profile, and authorized_keys on affected hosts for unexpected entries.
- Restrict write permissions on shell profile files and the .ssh directory to the owning user only.
- Keep a known-good baseline of authorized_keys and alert on any deviation.
- Rotate SSH keys and review recent logins if an unauthorized authorized_keys entry is found.

---
Source: https://www.netzilo.com/threats/shell-config-modification-periodic