<jupyter_start><jupyter_text>T1546.004 - Event Triggered Execution: .bash_profile and .bashrcAdversaries may establish persistence by executing malicious content triggered by a user’s shell. ~/.bash_profile and ~/.bashrc are shell scripts that contain shell commands. These files are executed in a user's context when a new shell opens or when a user logs in so that their environment is set correctly.~/.bash_profile is executed for login shells and ~/.bashrc is executed for interactive non-login shells. This means that when a user logs in (via username and password) to the console (either locally or remotely via something like SSH), the ~/.bash_profile script is executed before the initial command prompt is returned to the user. After that, every time a new shell is opened, the ~/.bashrc script is executed. This allows users more fine-grained control over when they want certain commands executed. These shell scripts are meant to be written to by the local user to configure their own environment.The macOS Terminal.app is a little different in that it runs a login shell by default each time a new terminal window is opened, thus calling ~/.bash_profile each time instead of ~/.bashrc.Adversaries may abuse these shell scripts by inserting arbitrary shell commands that may be used to execute other binaries to gain persistence. Every time the user logs in or opens a new shell, the modified ~/.bash_profile and/or ~/.bashrc scripts will be executed.(Citation: amnesia malware)  Atomic Tests<jupyter_code>#Import the Module before running the tests.
# Checkout Jupyter Notebook at https://github.com/cyb3rbuff/TheAtomicPlaybook to run PS scripts.
Import-Module /Users/0x6c/AtomicRedTeam/atomics/invoke-atomicredteam/Invoke-AtomicRedTeam.psd1 - Force<jupyter_output><empty_output><jupyter_text>Atomic Test 1 - Add command to .bash_profileAdds a command to the .bash_profile file of the current user**Supported Platforms:** macos, linux Attack Commands: Run with `sh````shecho "/path/to/script.py" >> ~/.bash_profile```<jupyter_code>Invoke-AtomicTest T1546.004 -TestNumbers 1<jupyter_output><empty_output><jupyter_text>Atomic Test 2 - Add command to .bashrcAdds a command to the .bashrc file of the current user**Supported Platforms:** macos, linux Attack Commands: Run with `sh````shecho "/path/to/script.py" >> ~/.bashrc```<jupyter_code>Invoke-AtomicTest T1546.004 -TestNumbers 2<jupyter_output><empty_output>
{'fraction_non_alphanumeric': 0.07228418009087154, 'fraction_numerical': 0.01197852127220157, 'mean_word_length': 5.178571428571429, 'pattern_counts': {'":': 0, '<': 13, '<?xml version=': 0, '>': 17, 'https://': 1, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'chain_length': '3', 'dir': 'jupyter-structured-clean-dedup', 'id': '524397', 'license': 'MIT', 'n_tokens_mistral': 702, 'n_tokens_neox': 643, 'n_words': 303, 'path': 'playbook/tactics/privilege-escalation/T1546.004.ipynb', 'repo_name': 'haresudhan/The-AtomicPlaybook', 'size': '2421'}