Threadlinqs IntelligenceStart free

ATT&CK techniquePersistencePrivilege Escalation

T1546.004 Unix Shell Configuration Modification

PersistencePrivilege EscalationEnterpriseSub-technique

As of 2026-10-05, T1546.004 (Unix Shell Configuration Modification) appears in 28 tracked threats, first reported 2026-03-24 and most recently 2026-09-30, with linked actors including TeamPCP, Shai-Hulud, ClickLock Dev; it most often appears alongside T1027 (Obfuscated Files or Information).

Tracked threats
2810 critical, 18 high
First seen
2026-03-24
Last seen
2026-09-30
Threat actors
7In the threats using it
Detection rules
63Blue tier and above

Data as of:

Activity timeline

T1546.004 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 15 reports, and 28 of the 28 threats were reported in the twelve months to 2026-09.

How adversaries use it

T1546.004 Unix Shell Configuration Modification is catalogued by MITRE ATT&CK under the Persistence and Privilege Escalation tactics in the Enterprise matrix, as a sub-technique of T1546 Event Triggered Execution. Threadlinqs maps 28 of 2623 tracked threats (1.1%) to it; by severity that is 10 critical, 18 high.

Threats that use T1546.004 most often also use T1027 Obfuscated Files or Information (21 threats), T1071.001 Web Protocols (20 threats), T1082 System Information Discovery (20 threats), T1005 Data from Local System (19 threats), T1059.004 Unix Shell (17 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

7 tracked threat actors appear in the threats that use T1546.004; the most frequent are TeamPCP (5), Shai-Hulud (2), ClickLock Dev (1), Contagious Interview cluster (1), PolinRider (1).

Mitigations

MITRE ATT&CK lists 1 mitigation for T1546.004.

Data sources

Telemetry that can reveal T1546.004, per MITRE ATT&CK.

  • Command — Command Execution
  • File — File Creation, File Modification
  • Process — Process Creation

Threat actors using it

Tracked threats

28 tracked threats use T1546.004.

Detection coverage

Threadlinqs maintains 63 detection rules mapped to T1546.004 (SPL 23, KQL 19, Sigma 21). Rule content is available to Blue tier accounts and above; this page shows counts only.

63 detection rules (SPL/KQL/Sigma) · Blue and above. Compare plans

Parent technique

T1546 Event Triggered Execution — 145 tracked threats at the technique level.