Shell history access

BIOC Informational

Shell history access

Attackers may search historical commands for credentials and information gathering.

Module:: Platform Analytics
Agent event type:: Process execution
Category:: Credential Access
Status:: Enabled

ATT&CK tactics: Credential Access (TA0006)

ATT&CK techniques: Unsecured Credentials: Shell History (T1552.003)

Indicator:

Process action type = execution AND target process name = cat , grep AND target process cmd =~ .*\.(ba|z|fi|tc|c|k)?sh_history* Host host os = linux , macos

Preventable: yes