Linux Process Command-Line Printing of Shell History Files

title: Linux Process Command-Line Printing of Shell History Files
id: d73c0c73-0df1-432e-9f7a-2b709d042d92
status: test
description: This rule flags Linux process executions where common paging/view commands (cat/head/tail/more) are used to read shell history file contents via the command line. Adversaries commonly access history files to recover prior commands, user activity, and potential credentials or reconnaissance targets. The detection relies on process creation telemetry and matches command-line strings containing or ending with typical history file paths and names such as .bash_history and .zsh_history.
references:
  - https://github.com/sleventyeleven/linuxprivchecker/
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_history_recon.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-06-20
modified: 2022-09-15
tags:
  - attack.reconnaissance
  - attack.t1592.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - /cat
      - /head
      - /tail
      - /more
  selection_history:
    - CommandLine|contains:
        - /.bash_history
        - /.zsh_history
    - CommandLine|endswith:
        - _history
        - .history
        - zhistory
  condition: all of selection*
falsepositives:
  - Legitimate administration activities
level: medium
license: DRL-1.1
related:
  - id: d7821ff1-4527-4e33-9f84-d0d57fa2fb66
    type: derived