Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters. tactic: TA0005 ✕

Download CSV Show ATT&CK heatmap
  • Uncommon attempt to clear shell history Low 1 variation

    An attempt to clear or manipulate shell history files was detected.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Stealth (TA0005)
    ATT&CK techniques: Indicator Removal (T1070)
    Required data: XDR Agent
    Attacker's goals: Attackers may clear or modify shell history files to remove traces of their activities.
    Investigative actions: Investigate the user and process that executed the command. Examine other related activities on the host to understand the context of this action.

    Variations

    Globally uncommon attempt to clear shell history

    Medium overridden

    An attempt to clear or manipulate shell history files was detected. overridden