T1504

A PowerShell profile (profile.ps1) is a script that runs when PowerShell starts and can be used as a logon script to customize user environments. Adversaries may modify these profiles to include arbitrary commands, functions, modules, and/or PowerShell drives to gain persistence.

Adding it as a PBA:
- LINUX: not applicable (T1156)
- WINDOWS: refer to this and this

Mapping the technique to the ATT&CK matrix