1200KM / detection
T1070.003 Clear Command History — Detection Rules
Detection workspace for T1070.003 Clear Command History: 9 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
- Linux Command History Tampering · test · high · {"product":"linux"}
- Cisco Clear Logs · test · high · {"product":"cisco","service":"aaa"}
- Clear PowerShell History - PowerShell Module · test · medium · {"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"}
- Clear PowerShell History - PowerShell · test · medium · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
- Clearing Windows Console History · test · high · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
- Disable Powershell Command History · test · high · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
- Suspicious IO.FileStream · test · medium · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
- RunMRU Registry Key Deletion · experimental · high · {"category":"process_creation","product":"windows"}
- RunMRU Registry Key Deletion - Registry · experimental · high · {"category":"registry_delete","product":"windows"}
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0165 Behavioral Detection of Command History Clearing
AN0467 Analytic 0467
Detects adversary behavior clearing command history via `history -c`, deletion or modification of ~/.bash_history, or manipulation of the HISTFILE environment variable post-login.
AN0468 Analytic 0468
Detects adversary clearing shell history using `history -c` or deleting/altering ~/.zsh_history or ~/.bash_history. Focus on sessions with missing or wiped history.
AN0469 Analytic 0469
Detects PowerShell `Clear-History` invocation or deletion of `ConsoleHost_history.txt` to erase past PowerShell session history.
AN0470 Analytic 0470
Detects modification or truncation of `/var/log/shell.log` used to persist ESXi shell command history. Especially suspicious shortly after login or config changes.
AN0471 Analytic 0471
Detects use of `clear history` or `clear logging` commands on network device CLI to remove past activity logs.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
T1070.003 simulation workspace
No reviewed association in this snapshot.
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.