Source
**This technique has been deprecated and should no longer be used.**
The source
command loads functions into the current shell or executes files in the current context. This built-in command can be run in two different ways source /path/to/filename [arguments]
or .**This technique has been deprecated and should no longer be used.** /path/to/filename [arguments]
. Take note of the space after the ".". Without a space, a new shell is created that runs the program instead of running the program within the current context. This is often used to make certain features or functions available to a shell or to update a specific shell's environment.(Citation: Source Manual)
Adversaries can abuse this functionality to execute programs. The file executed with this technique does not need to be marked executable beforehand.
Mitigations |
|
Mitigation | Description |
---|---|
Source Mitigation |
Due to potential legitimate uses of source commands, it's may be difficult to mitigate use of this technique. |
Detection
Monitor for command shell execution of source and subsequent processes that are started as a result of being executed by a source command. Adversaries must also drop a file to disk in order to execute it with source, and these files can also detected by file monitoring.
Связанные риски
Каталоги
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.