Linux History File Deletion via rm/unlink/shred Commands

Alert on Linux command-line history file deletions using rm/unlink/shred targeting bash/zsh history files.

FreeUnreviewedSigmahighv1

linux-history-file-deletion-via-rm-unlink-shred-commands-1182f3b3

title: Linux History File Deletion via rm/unlink/shred Commands
id: d30cdc34-ef14-4899-83ea-07813099b5b9
status: test
description: This rule flags process executions running common file-deletion utilities (/rm, /unlink, /shred) where the command line references user shell history files such as /.bash_history and /.zsh_history. Deleting history can remove traces of prior commands and hinder incident investigation. The detection relies on Linux process creation telemetry capturing the executable name suffix and the full command line contents/endings that match history-related paths.
references:
  - https://github.com/sleventyeleven/linuxprivchecker/
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_history_delete.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-06-20
modified: 2022-09-15
tags:
  - attack.impact
  - attack.t1565.001
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - /rm
      - /unlink
      - /shred
  selection_history:
    - CommandLine|contains:
        - /.bash_history
        - /.zsh_history
    - CommandLine|endswith:
        - _history
        - .history
        - zhistory
  condition: all of selection*
falsepositives:
  - Legitimate administration activities
level: high
license: DRL-1.1
related:
  - id: 1182f3b3-e716-4efa-99ab-d2685d04360f
    type: derived

What it detects

This rule flags process executions running common file-deletion utilities (/rm, /unlink, /shred) where the command line references user shell history files such as /.bash_history and /.zsh_history. Deleting history can remove traces of prior commands and hinder incident investigation. The detection relies on Linux process creation telemetry capturing the executable name suffix and the full command line contents/endings that match history-related paths.

Known false positives

Legitimate administration activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.