diff --git a/atomics/T1059.004/T1059.004.yaml b/atomics/T1059.004/T1059.004.yaml index 5b71a940..8f1664a9 100644 --- a/atomics/T1059.004/T1059.004.yaml +++ b/atomics/T1059.004/T1059.004.yaml @@ -99,6 +99,7 @@ atomic_tests: rm -rf #{linenum} name: sh - name: New script file in the tmp directory + auto_generated_guid: 8cd1947b-4a54-41fb-b5ea-07d0ace04f81 description: | An attacker may create script files in the /tmp directory using the mktemp utility and execute them. The following commands creates a temp file and places a pointer to it in the variable $TMPFILE, echos the string id into it, and then executes the file using bash, which results in the id command being executed. supported_platforms: diff --git a/atomics/used_guids.txt b/atomics/used_guids.txt index 88c1ae81..bcecb9c1 100644 --- a/atomics/used_guids.txt +++ b/atomics/used_guids.txt @@ -1215,3 +1215,4 @@ c6952f41-6cf0-450a-b352-2ca8dae7c178 01d75adf-ca1b-4dd1-ac96-7c9550ad1035 0709945e-4fec-4c49-9faf-c3c292a74484 15330820-d405-450b-bd08-16b5be5be9f4 +8cd1947b-4a54-41fb-b5ea-07d0ace04f81