Linux Process Command-Line Printing of Shell History Files
Alerts when Linux commands print or page shell history files via the command line for recon.
- Product
- linux
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-06-20
- Updated
- 2026-07-31
ATT&CK techniques
ReconResource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Linux process executions where the command line invokes common file-viewing utilities (cat/head/tail/more) and targets shell history files such as /.bash_history and /.zsh_history, including history-related filename suffixes. Attackers may use this behavior to quickly recover previously executed commands for reconnaissance and follow-on activity. It relies on process creation telemetry capturing the invoked image name and full command line content.
Reporting behind it
- github.comhttps://github.com/sleventyeleven/linuxprivchecker/
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_history_recon.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux Process Command-Line Printing of Shell History Files
id: d73c0c73-0df1-432e-9f7a-2b709d042d92
status: test
description: This rule flags Linux process executions where the command line invokes common file-viewing utilities (cat/head/tail/more) and targets shell history files such as /.bash_history and /.zsh_history, including history-related filename suffixes. Attackers may use this behavior to quickly recover previously executed commands for reconnaissance and follow-on activity. It relies on process creation telemetry capturing the invoked image name and full command line content.
references:
- https://github.com/sleventyeleven/linuxprivchecker/
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_history_recon.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-06-20
modified: 2022-09-15
tags:
- attack.reconnaissance
- attack.t1592.004
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith:
- /cat
- /head
- /tail
- /more
selection_history:
- CommandLine|contains:
- /.bash_history
- /.zsh_history
- CommandLine|endswith:
- _history
- .history
- zhistory
condition: all of selection*
falsepositives:
- Legitimate administration activities
level: medium
license: DRL-1.1
related:
- id: d7821ff1-4527-4e33-9f84-d0d57fa2fb66
type: derived