Linux Shell History File Access via Executed Commands

title: Linux Shell History File Access via Executed Commands
id: f94734cc-932a-48a8-b3d3-349d5011b96e
status: test
description: This rule flags command execution events where the executed command targets common shell history files such as .bash_history, .zsh_history, .history, .sh_history, fish_history, or .zhistory. Accessing or manipulating history files can help attackers recover prior commands, hide activity, or prepare further credential and command discovery. It relies on Linux auditd telemetry capturing execve activity and string matches against those history file paths.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_susp_histfile_operations.yml
author: Mikhail Larin, oscd.community, Huntrule Team
date: 2020-10-17
modified: 2022-11-28
tags:
  - attack.credential-access
  - attack.t1552.003
logsource:
  product: linux
  service: auditd
detection:
  execve:
    type: EXECVE
  history:
    - .bash_history
    - .zsh_history
    - .zhistory
    - .history
    - .sh_history
    - fish_history
  condition: execve and history
falsepositives:
  - Legitimate administrative activity
  - Legitimate software, cleaning hist file
level: medium
license: DRL-1.1
related:
  - id: eae8ce9f-bde9-47a6-8e79-f20d18419910
    type: derived