Update T1053.003.yaml (#1221)

Add code to make cleanup commands. Co-authored-by: Carrie Roberts <[email protected]>
redcanaryco · Sep 15, 2020 · 7b90e89 · 7b90e89
1 parent 45f59ad
commit 7b90e89
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/atomics/T1053.003/T1053.003.yaml b/atomics/T1053.003/T1053.003.yaml
@@ -25,7 +25,10 @@ atomic_tests:
   executor:
     name: bash
     command: |
+      crontab -l > /tmp/notevil
       echo "* * * * * #{command}" > #{tmp_cron} && crontab #{tmp_cron}
+    cleanup_command: |
+      crontab /tmp/notevil
 
 - name: Cron - Add script to cron folder
   auto_generated_guid: b7d42afa-9086-4c8a-b7b0-8ea3faa6ebb0
@@ -50,4 +53,6 @@ atomic_tests:
     elevation_required: true
     name: bash
     command: |
-      echo "#{command}" > /etc/cron.daily/#{cron_script_name}
+      echo "#{command}" > /etc/cron.daily/#{cron_script_name}
+    cleanup_command: |
+      rm /etc/cron.daily/#{cron_script_name}