Suspicious History File Operations - Linux — Sigma Rule

Rule metadata and linked tags

Author: Mikhail Larin, oscd.community. Source status: test; severity: medium. Source dates: 2020-10-17 / 2022-11-28.

{
  "product": "linux",
  "service": "auditd"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 6e1a35503e21c441c8c7ea8aa6ed46b5c105f785a515a72156bd597984c3acad

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Suspicious History File Operations - Linux
id: eae8ce9f-bde9-47a6-8e79-f20d18419910
status: test
description: 'Detects commandline operations on shell history files'
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md
author: 'Mikhail Larin, oscd.community'
date: 2020-10-17
modified: 2022-11-28
tags:
    - attack.credential-access
    - attack.t1552.003
logsource:
    product: linux
    service: auditd
detection:
    execve:
        type: EXECVE
    history:
        - '.bash_history'
        - '.zsh_history'
        - '.zhistory'
        - '.history'
        - '.sh_history'
        - 'fish_history'
    condition: execve and history
falsepositives:
    - Legitimate administrative activity
    - Legitimate software, cleaning hist file
level: medium

Original YAML and metadata in JSON

False positives

• Legitimate administrative activity
• Legitimate software, cleaning hist file

Source references

• https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md