T1070.003sub-technique of T1070 Indicator Removal
Clear Command History
ESXi · Linux · macOS · Network Devices · Windowsnothing on this site yetT1070.003 on attack.mitre.org
In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done. On Linux and macOS, these command histories can be accessed in a few different ways.
how MITRE says to see it
Behavioral Detection of Command History Clearing
- Detects adversary behavior clearing command history via `history -c`, deletion or modification of ~/.bash_history, or manipulation of the HISTFILE environment variable post-login.
- Detects adversary clearing shell history using `history -c` or deleting/altering ~/.zsh_history or ~/.bash_history. Focus on sessions with missing or wiped history.
- Detects PowerShell `Clear-History` invocation or deletion of `ConsoleHost_history.txt` to erase past PowerShell session history.
- Detects modification or truncation of `/var/log/shell.log` used to persist ESXi shell command history. Especially suspicious shortly after login or config changes.
what reduces it
- M1029 Remote Data Storage. Forward logging of historical data to remote data store and centralized logging solution to preserve historical command line log data.
- M1039 Environment Variable Permissions. Making the environment variables associated with command history read only may ensure that the history is preserved.
- M1022 Restrict File and Directory Permissions. Preventing users from deleting or writing to certain files can stop adversaries from maliciously altering their `~/.bash_history` or `ConsoleHost_history.txt` files.