huntrule

macOS Process Creation: Command Line Access to Shell History Files

Flags macOS command lines referencing common shell history files, which may indicate credential access or cover-tracks behavior.

FreeReviewedSigma · Medium · v2
Product
macos
Category
process_creation
Author
Mikhail Larin, oscd.community (SigmaHQ), DRL 1.1
Published
2020-10-17
Updated
2026-07-31
AnalysisDetection
title: "macOS Process Creation: Command Line Access to Shell History Files"
id: 86b5178d-f108-4772-8c3b-2450a7548e90
status: test
description: This rule flags macOS process executions where the command line contains references to common shell history files (e.g., .bash_history, .zsh_history, .history). Attackers may read, modify, or clear these files to discover prior commands or to cover their tracks. The detection relies on process creation telemetry and specifically inspects the command line text for these history file names.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_susp_histfile_operations.yml
author: Mikhail Larin, oscd.community, Huntrule Team
date: 2020-10-17
modified: 2021-11-27
tags:
  - attack.credential-access
  - attack.t1552.003
logsource:
  product: macos
  category: process_creation
detection:
  selection:
    CommandLine|contains:
      - .bash_history
      - .zsh_history
      - .zhistory
      - .history
      - .sh_history
      - fish_history
  condition: selection
falsepositives:
  - Legitimate administrative activity
  - Legitimate software, cleaning hist file
level: medium
license: DRL-1.1
related:
  - id: 508a9374-ad52-4789-b568-fc358def2c65
    type: derived