macOS Process Creation: Command Line Access or Modification of Shell History Files

Flags macOS command lines referencing common shell history files, which may indicate credential access or cover-tracks behavior.

FreeUnreviewedSigmamediumv1

macos-process-creation-command-line-access-or-modification-of-shell-history-file-508a9374

title: "macOS Process Creation: Command Line Access or Modification of Shell History Files"
id: 86b5178d-f108-4772-8c3b-2450a7548e90
status: test
description: This rule flags macOS process executions where the command line contains names of common shell history files such as .bash_history, .zsh_history, .history, .sh_history, and fish_history. Attackers may use history file operations to cover tracks, manipulate recorded commands, or access prior user activity. It relies on process creation telemetry that includes the full command line, allowing detection of history file references in executed commands.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_susp_histfile_operations.yml
author: Mikhail Larin, oscd.community, Huntrule Team
date: 2020-10-17
modified: 2021-11-27
tags:
  - attack.credential-access
  - attack.t1552.003
logsource:
  product: macos
  category: process_creation
detection:
  selection:
    CommandLine|contains:
      - .bash_history
      - .zsh_history
      - .zhistory
      - .history
      - .sh_history
      - fish_history
  condition: selection
falsepositives:
  - Legitimate administrative activity
  - Legitimate software, cleaning hist file
level: medium
license: DRL-1.1
related:
  - id: 508a9374-ad52-4789-b568-fc358def2c65
    type: derived

What it detects

This rule flags macOS process executions where the command line contains names of common shell history files such as .bash_history, .zsh_history, .history, .sh_history, and fish_history. Attackers may use history file operations to cover tracks, manipulate recorded commands, or access prior user activity. It relies on process creation telemetry that includes the full command line, allowing detection of history file references in executed commands.

Known false positives

Legitimate administrative activity
Legitimate software, cleaning hist file

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.