attack_technique: T1546.005
display_name: 'Event Triggered Execution: Trap'
atomic_tests:
- name: Trap
  auto_generated_guid: a74b2e07-5952-4c03-8b56-56274b076b61
  description: |
    After exiting the shell, the script will download and execute.
    After sending a keyboard interrupt (CTRL+C) the script will download and execute.
  supported_platforms:
  - macos
  - linux
  executor:
    command: |
      trap "nohup sh $PathToAtomicsFolder/T1546.005/src/echo-art-fish.sh | bash" EXIT
      exit
      trap "nohup sh $PathToAtomicsFolder/T1546.005/src/echo-art-fish.sh | bash" SIGINt
    name: sh
