Linux: Command-Line Access to Shell History Files via execve
Alerts when executed commands reference common Linux shell history files.
- Product
- linux
- Service
- auditd
- Author
- Mikhail Larin, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-10-17
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags processes that invoke execution while targeting common shell history files such as .bash_history, .zsh_history, .history, and fish_history. Attackers may access or modify shell history to cover tracks, reconstruct prior commands, or stage follow-on activity. It relies on Linux auditd execve telemetry combined with process arguments matching the specified history file paths.
Reporting behind it
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Linux: Command-Line Access to Shell History Files via execve"
id: f94734cc-932a-48a8-b3d3-349d5011b96e
status: test
description: This rule flags processes that invoke execution while targeting common shell history files such as .bash_history, .zsh_history, .history, and fish_history. Attackers may access or modify shell history to cover tracks, reconstruct prior commands, or stage follow-on activity. It relies on Linux auditd execve telemetry combined with process arguments matching the specified history file paths.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_susp_histfile_operations.yml
author: Mikhail Larin, oscd.community, Huntrule Team
date: 2020-10-17
modified: 2022-11-28
tags:
- attack.credential-access
- attack.t1552.003
logsource:
product: linux
service: auditd
detection:
execve:
type: EXECVE
history:
- .bash_history
- .zsh_history
- .zhistory
- .history
- .sh_history
- fish_history
condition: execve and history
falsepositives:
- Legitimate administrative activity
- Legitimate software, cleaning hist file
level: medium
license: DRL-1.1
related:
- id: eae8ce9f-bde9-47a6-8e79-f20d18419910
type: derived