Delete or rename shell history

Description

Detect shell history deletion, frequently used by unsophisticated adversaries to eliminate evidence. Note that it can also trigger when exiting a Terminal shell, such as with kubectl exec, which may introduce some noise.

Query · falco

(modify_shell_history or truncate_shell_history) and not var_lib_docker_filepath and not proc.name in (docker_binaries)

Rule dependencies

Depends on

  • composes · Falco macro modify_shell_history
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro truncate_shell_history
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro var_lib_docker_filepath
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Shell history deleted or renamed | file=%fd.name name=%evt.arg.name path=%evt.arg.path oldpath=%evt.arg.oldpath evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Delete or rename shell history · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Delete or rename shell history
desc: 'Detect shell history deletion, frequently used by unsophisticated adversaries
  to eliminate evidence. Note that it can also trigger when exiting a Terminal shell,
  such as with `kubectl exec`, which may introduce some noise.

  '
condition: '(modify_shell_history or truncate_shell_history) and not var_lib_docker_filepath
  and not proc.name in (docker_binaries)

  '
output: Shell history deleted or renamed | file=%fd.name name=%evt.arg.name path=%evt.arg.path
  oldpath=%evt.arg.oldpath evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid
  process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline
  terminal=%proc.tty
priority: WARNING
tags:
- maturity_incubating
- host
- container
- process
- filesystem
- mitre_defense_evasion
- T1070

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.