Add "`.bash_profile` and `.bashrc`" attack technique (T1156)

[shreyamalviya]

T1156

~/.bash_profile and ~/.bashrc are shell scripts that are executed in a user's context when a new shell is opened or when a user logs in so that their environment is set correctly. Adversaries may abuse these shell scripts by adding arbitrary commands that may be used to execute other binaries to gain persistence. Every time the user logs in or opens a new shell, the modified ~/.bash_profile and/or ~/.bashrc scripts will be executed.

Adding it as a PBA:
- LINUX: attempt to add some command (will be commented) to .bash_profile and .bashrc by echo-ing it into the file, and then removing it using sed
- WINDOWS: do the same for profile files in Powershell (refer to this) T1504

Mapping the technique to the ATT&CK matrix

[acepace]

There's an equivalent of bashrc with powershell profiles.
How will we handle making sure we don't cause real changes to the files?

[shreyamalviya]

Oh yeah, updated!

You mean how we'll make sure we're not leaving arbitrary commands in the files? I was thinking we'd add only a comment to the file so that even if there's some issue with deleting it from the file afterwards, it won't execute a random command. Did you mean something else?

[acepace]

I'm pro that. Another option is to add a simple output statement to them so they print on startup.
We should also ask if we want to infect all users we can see, or just the user we're currently running on.

[shreyamalviya]

Yeah, although how would we add that to the configuration page? A separate section for just this one PBA?