BIOC
Informational
✕
Shell History Access
Access to files holding shell history information.
- Module:
- Platform Analytics
- Agent event type:
- File
- Category:
- Credential Access
- Status:
- Enabled
ATT&CK tactics: Credential Access (TA0006) Collection (TA0009)
ATT&CK techniques: Input Capture: Keylogging (T1056.001)
Indicator:
File action type = read , rename , delete , write AND file name = .zsh_history , .bash_history , .sh_history
Preventable: yes