T1552.003sub-technique of T1552 Unsecured Credentials
Shell History
Linux · macOS · Windowsnothing on this site yetT1552.003 on attack.mitre.org
Adversaries may search the command history on compromised systems for insecurely stored credentials. On Linux and macOS systems, shells such as Bash and Zsh keep track of the commands users type on the command-line with the "history" utility. Once a user logs out, the history is flushed to the user's history file. For each user, this file resides at the same location: for example, `~/.bash_history` or `~/.zsh_history`.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Cloud account compromise
Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.
how MITRE says to see it
Detect Access and Parsing of.bash_history Files for Credential Harvesting
- A process outside of interactive shell context reads ~/.bash_history directly (e.g., using cat, less, grep), often shortly after privilege escalation or user switch (su/sudo). This may be followed by credential scanning in memory or file writes to new locations.
- A process or terminal command outside of standard shell utilities reads the user's.bash_history file. On macOS, unified logs or telemetry tools like EndpointSecurity (ESF) may observe file read APIs or terminal process lineage that shows non-user-initiated access.
what reduces it
- M1028 Operating System Configuration. There are multiple methods of preventing a user's command history from being flushed to their.bash_history file, including use of the following commands: `set +o history` and `set -o history` to start logging again; `unset HISTFILE` being added to a user's.bash_rc file; and `ln -s /dev/null ~/.bash_history` to write commands to `/dev/null` instead. In Zsh, `fc -p` can be used to create a private history session.