Planted shell commands and scripts that phone home when executed. Know instantly when an attacker runs code in your environment — proof of active compromise.
$ cat /opt/scripts/db-backup.sh
#!/bin/bash
# Database backup script
curl -s https://t.tripwires.io/abc123
pg_dump prod_db > /backup/...
$ ./db-backup.sh
Backup complete.
[YOU ARE INSTANTLY ALERTED]
Source: 10.0.1.42 (prod-web-03)
User: www-data
Time: 2025-01-13 14:23:41 UTC
Execution triggers prove active compromise — not just reconnaissance, not credential theft, but actual code running in your environment.
Someone looked for a service. They know it exists.
Someone stole and used credentials. They have access.
Someone ran code. They are actively operating inside your environment.
Multiple formats to blend naturally into different environments.
Bash, sh, zsh
One-liner curl or wget commands that blend into scripts. Silent, no output, instant alert.
Python 2 & 3
Import-time or runtime triggers that report execution without affecting script behavior.
Windows environments
Silent web requests that work in Windows automation and admin scripts.
Docker, Kubernetes
Add to entrypoint scripts to detect when containers are started by unauthorized parties.
Scripts that attackers are likely to run when exploring a compromised system.
Fake "interesting" files that attackers will naturally want to execute or read.
Detect when employees access or run things they shouldn't.
Test your detection capabilities during security exercises.
When an execution trigger fires, you get full context on what happened.
Execution triggers are available in Enterprise plan at £499/month.