BIOC
Low
✕
Accessing bash history file using bash commands
Clearing bash history files is a known attacker procedure for covering their tracks.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Evasion
- Status:
- Enabled
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Indicator Removal: Clear Command History (T1070.003)
Indicator:
Process action type = execution AND target process cmd = *set histfile* , *set history* , *export histfile* , *export histignore* , *history -c* , *history -d* AND target process name = bash , sh
Preventable: yes