BIOC
Low
✕
Accessing bash history file
Clearing bash history file is a known procedure of attackers to delete traces.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Evasion
- Status:
- Enabled
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Indicator Removal: Clear Command History (T1070.003)
Indicator:
Process action type = execution AND target process cmd = *.bash_history * , *.bash_history , *histfile * , *histfile AND target process name = rm , touch , ln AND target process path != /Applications/OnyX.app/Contents/MacOS/OnyX
Preventable: yes