diff --git a/atomics/T1098.004/T1098.004.yaml b/atomics/T1098.004/T1098.004.yaml index 78783a05..af04208c 100644 --- a/atomics/T1098.004/T1098.004.yaml +++ b/atomics/T1098.004/T1098.004.yaml @@ -15,6 +15,6 @@ atomic_tests: name: bash elevation_required: false command: | - if [ -f ~/.ssh/authorized_keys ]; then ssh_authorized_keys=$(cat ~/.ssh/authorized_keys); echo $ssh_authorized_keys > ~/.ssh/authorized_keys; fi; + if [ -f ~/.ssh/authorized_keys ]; then ssh_authorized_keys=$(cat ~/.ssh/authorized_keys); echo "$ssh_authorized_keys" > ~/.ssh/authorized_keys; fi; cleanup_command: | unset ssh_authorized_keys