Analytics BIOC Low
✕

Uncommon attempt to clear shell history

An attempt to clear or manipulate shell history files was detected.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Indicator Removal (T1070)
Attacker's goals:

Attackers may clear or modify shell history files to remove traces of their activities.

Investigative actions:

Investigate the user and process that executed the command. Examine other related activities on the host to understand the context of this action.

Test period:
N/A (single event)
Deduplication:
1 Day
1 variation:
  • Globally uncommon attempt to clear shell history Medium (parent: Low)