id: break_agent
name: Break Agent
version: '1.0'
category: ncf_techniques
items:
  - id: 4c5453b1-d422-42e8-bfaf-5afee14517c5
    name: ''
    method: audit_from_command
    params:
      command: 'awk -F: ''($4 == ''"$(getent group shadow | awk -F: ''{print $3}''
        | xargs)"'') {}'' /etc/passwd'
      compliant_codes: '1'

