macOS Process Creation: Command Line Access to Shell History Files
Flags macOS command lines referencing common shell history files, which may indicate credential access or cover-tracks behavior.
- Product
- macos
- Category
- process_creation
- Author
- Mikhail Larin, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-10-17
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags macOS process executions where the command line contains references to common shell history files (e.g., .bash_history, .zsh_history, .history). Attackers may read, modify, or clear these files to discover prior commands or to cover their tracks. The detection relies on process creation telemetry and specifically inspects the command line text for these history file names.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "macOS Process Creation: Command Line Access to Shell History Files"
id: 86b5178d-f108-4772-8c3b-2450a7548e90
status: test
description: This rule flags macOS process executions where the command line contains references to common shell history files (e.g., .bash_history, .zsh_history, .history). Attackers may read, modify, or clear these files to discover prior commands or to cover their tracks. The detection relies on process creation telemetry and specifically inspects the command line text for these history file names.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_susp_histfile_operations.yml
author: Mikhail Larin, oscd.community, Huntrule Team
date: 2020-10-17
modified: 2021-11-27
tags:
- attack.credential-access
- attack.t1552.003
logsource:
product: macos
category: process_creation
detection:
selection:
CommandLine|contains:
- .bash_history
- .zsh_history
- .zhistory
- .history
- .sh_history
- fish_history
condition: selection
falsepositives:
- Legitimate administrative activity
- Legitimate software, cleaning hist file
level: medium
license: DRL-1.1
related:
- id: 508a9374-ad52-4789-b568-fc358def2c65
type: derived