diff --git a/atomics/T1546.004/T1546.004.yaml b/atomics/T1546.004/T1546.004.yaml index e446de65..83f57c8e 100644 --- a/atomics/T1546.004/T1546.004.yaml +++ b/atomics/T1546.004/T1546.004.yaml @@ -94,6 +94,7 @@ atomic_tests: cleanup_command: | sed -i "s/# Atomic Red Team was here... T1546.004//" /etc/profile.d/bash_completion.sh - name: Create/Append to .bash_logout + auto_generated_guid: 37ad2f24-7c53-4a50-92da-427a4ad13f58 description: | The Bash shell runs ~/.bash_logout "if it exists" to run commands on user logout. An adversary may create or append to a .bash_logout to clear history, start processes etc. Note the ~/.bash_logout is only run if you explicitly exit or log out of an "interactive login shell session" i.e. via the console, SSH, /bin/bash -l or su -l . diff --git a/atomics/used_guids.txt b/atomics/used_guids.txt index 4c9a7353..53962ac2 100644 --- a/atomics/used_guids.txt +++ b/atomics/used_guids.txt @@ -1303,3 +1303,4 @@ f12acddb-7502-4ce6-a146-5b62c59592f1 0315bdff-4178-47e9-81e4-f31a6d23f7e4 2b93758e-a8d7-4e3b-bc7b-d3aa8d7ecb17 fca246a8-a585-4f28-a2df-6495973976a1 +37ad2f24-7c53-4a50-92da-427a4ad13f58