{"id":"fdc88d25-96fb-4b7c-9633-c0e417fdbd4e","title":"Linux Command History Tampering","description":"Detects commands that try to clear or tamper with the Linux command history.\nThis technique is used by threat actors in order to evade defenses and execute commands without them being recorded in files such as \"bash_history\" or \"zsh_history\".\n","author":"Patrick Bareiss","status":"test","level":"high","date":"2019-03-24","modified":"2024-04-17","tags":["attack.stealth","attack.t1070.003"],"technique_ids":["T1070.003"],"logsource":{"product":"linux"},"falsepositives":["Unknown"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.003/T1070.003.md","https://www.hackers-arise.com/post/2016/06/20/covering-your-bash-shell-tracks-antiforensics","https://www.cadosecurity.com/spinning-yarn-a-new-linux-malware-campaign-targets-docker-apache-hadoop-redis-and-confluence/"],"source_path":"rules/linux/builtin/lnx_shell_clear_cmd_history.yml","source_sha256":"66df93044b76c6f0e52bd2db5a437c89da13a9ad97f8334c9d6f714f0a1a4531","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/builtin/lnx_shell_clear_cmd_history.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Linux Command History Tampering\nid: fdc88d25-96fb-4b7c-9633-c0e417fdbd4e\nstatus: test\ndescription: |\n    Detects commands that try to clear or tamper with the Linux command history.\n    This technique is used by threat actors in order to evade defenses and execute commands without them being recorded in files such as \"bash_history\" or \"zsh_history\".\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.003/T1070.003.md\n    - https://www.hackers-arise.com/post/2016/06/20/covering-your-bash-shell-tracks-antiforensics\n    - https://www.cadosecurity.com/spinning-yarn-a-new-linux-malware-campaign-targets-docker-apache-hadoop-redis-and-confluence/\nauthor: Patrick Bareiss\ndate: 2019-03-24\nmodified: 2024-04-17\ntags:\n    - attack.stealth\n    - attack.t1070.003\nlogsource:\n    product: linux\ndetection:\n    keywords:\n        - 'cat /dev/null >*sh_history'\n        - 'cat /dev/zero >*sh_history'\n        - 'chattr +i*sh_history'\n        - 'echo \"\" >*sh_history'\n        - 'empty_bash_history'\n        - 'export HISTFILESIZE=0'\n        - 'history -c'\n        - 'history -w'\n        - 'ln -sf /dev/null *sh_history'\n        - 'ln -sf /dev/zero *sh_history'\n        - 'rm *sh_history'\n        - 'shopt -ou history'\n        - 'shopt -uo history'\n        - 'shred *sh_history'\n        - 'truncate -s0 *sh_history'\n        # - 'unset HISTFILE'  # prone to false positives\n    condition: keywords\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1070.003","id":"T1070.003","name":"Clear Command History","page":"techniques/enterprise/T1070.003/"}],"data_path":"data/detection-rules/fdc88d25-96fb-4b7c-9633-c0e417fdbd4e.json","kind":"sigma"}