Cross-source coverage

T1070.003 / ATT&CK

Indicator Removal: Clear Command History

25 rules · 24 families across 5 sources.

From MITRE ATT&CK 19.2

In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done.

On Linux and macOS, these command histories can be accessed in a few different ways. While logged in, this command history is tracked in a file pointed to by the environment variable HISTFILE. When a user logs off a system, this information is flushed to a file in the user's home directory called ~/.bash_history. The benefit of this is that it allows users to go back to commands they've used before in different sessions. Adversaries may delete their commands from these logs by manually clearing the history (history -c) or deleting the bash history file rm ~/.bash_history.

Adversaries may also leverage a Network Device CLI on network devices to clear command history data (clear logging and/or clear history). On ESXi servers, command history may be manually removed from the /var/log/shell.log file.

On Windows hosts, PowerShell has two different command history providers: the built-in history and the command history managed by the PSReadLine module. The built-in history only tracks the commands used in the current session. This command history is not available to other sessions and is deleted when the session ends.

The PSReadLine command history tracks the commands used in all PowerShell sessions and writes them to a file ($env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt by default). This history file is available to all sessions and contains all past history since the file is not deleted when the session ends.

Adversaries may run the PowerShell command Clear-History to flush the entire command history from a current PowerShell session. This, however, will not delete/flush the ConsoleHost_history.txt file. Adversaries may also delete the ConsoleHost_history.txt file or edit its contents to hide PowerShell commands they have run.

Tactics: Stealth
Platforms: ESXi · Linux · macOS · Network Devices · Windows
Telemetry: auditd:SYSCALLmacos:unifiedlogfs:fsusageWinEventLog:PowerShellWinEventLog:SysmonWinEventLog:Securityesxi:shellnetworkdevice:syslog

How MITRE says to detect it DET0165

Behavioral Detection of Command History Clearing

Linux Analytic 0467

Detects adversary behavior clearing command history via `history -c`, deletion or modification of ~/.bash_history, or manipulation of the HISTFILE environment variable post-login.

auditd:SYSCALL execve
auditd:SYSCALL PATH

macOS Analytic 0468

Detects adversary clearing shell history using `history -c` or deleting/altering ~/.zsh_history or ~/.bash_history. Focus on sessions with missing or wiped history.

macos:unifiedlog process
fs:fsusage unlink, write

Windows Analytic 0469

Detects PowerShell `Clear-History` invocation or deletion of `ConsoleHost_history.txt` to erase past PowerShell session history.

WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106
WinEventLog:Sysmon EventCode=23
WinEventLog:Security EventCode=4663, 4670, 4656

ESXi Analytic 0470

Detects modification or truncation of `/var/log/shell.log` used to persist ESXi shell command history. Especially suspicious shortly after login or config changes.

esxi:shell /var/log/shell.log

Network Devices Analytic 0471

Detects use of `clear history` or `clear logging` commands on network device CLI to remove past activity logs.

networkdevice:syslog CLI command audit

View on attack.mitre.org ↗

SigmaHQ/sigma

9 rules

Detection	Severity	Format
Cisco Clear Logs	High	Sigma
Clearing Windows Console History	High	Sigma
Disable Powershell Command History	High	Sigma
Linux Command History Tampering	High	Sigma
RunMRU Registry Key Deletion	High	Sigma
RunMRU Registry Key Deletion - Registry	High	Sigma
Clear PowerShell History - PowerShell	Medium	Sigma
Clear PowerShell History - PowerShell Module	Medium	Sigma
Suspicious IO.FileStream	Medium	Sigma

socfortress/Wazuh-Rules

6 rules

Detection	Severity	Format
Command to read or clear data using /dev/null detected: cat /dev/null	High	Wazuh XML
Command to read or clear data using /dev/null detected: cat /dev/null command = cat /dev/null	High	Wazuh XML
Command to remove bash history detected: rm /root/.bash_history	High	Wazuh XML
Command to remove bash history detected: rm /root/.bash_history command = rm /root/.bash_history	High	Wazuh XML
Command to symlink /root/.bash_history to /dev/null detected: ln -sf	High	Wazuh XML
Command to symlink /root/.bash_history to /dev/null detected: ln -sf command = ln -sf /dev/null /root/.bash_history	High	Wazuh XML

elastic/detection-rules

4 rules

Detection	Severity	Format
Shell Command-Line History Deletion Detected via Defend for Containers	High	Elastic TOML
Shell History Clearing via Environment Variables	High	Elastic TOML
Clearing Windows Console History	Medium	Elastic TOML
Tampering of Shell Command-Line History	Medium	Elastic TOML

elastic/protections-artifacts

4 rules

Detection	Severity	Format
Clearing of Shell History via Environment Variables	Undefined	Elastic TOML
Deletion of Shell History File	Undefined	Elastic TOML
Suspicious PowerShell Console History Deletion	Undefined	Elastic TOML
Tampering of Bash Command-Line History	Undefined	Elastic TOML

splunk/security_content

2 rules

Detection	Severity	Format
Windows ConsoleHost History File Deletion	Undefined	SPL
Windows Powershell History File Deletion	Undefined	SPL