huntrule

Suspicious Bash History Clearing for Anti-Forensics on Linux (via process_creation)

PremiumReviewedSigma · Medium · v1
Product
linux
Category
process_creation
Author
HuntRule
Published
2026-10-31
Updated
2026-10-31
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects Linux command lines that truncate, redirect over, or remove the bash_history file to destroy evidence of executed commands. Attackers routinely clear shell history after hands-on-keyboard activity to obstruct forensic reconstruction. Detecting this indicator anti-forensic behavior helps flag interactive intrusion cleanup.

Reporting behind it

Related detections9 linkedT1070.003 — drag to rearrange
Suspicious Shell History Anti-Forensics via HISTFILE Manipulation
Suspicious Shell History and Log Clearing on Linux
Suspicious Shell History Disabling via HISTFILE Redirection on Linux
Suspicious Shell History Clearing or Disabling (via process_creation)
Suspicious COLDRIVER RunMRU History Clearing via Reg Delete (via process_creation)
Suspicious File Immutability Set via chattr for Anti-Removal on Linux
Suspicious Clearing of Linux Authentication and History Logs
Windows Registry RunMRU Key Deletion
Windows: Detect reg.exe Deletion of RunMRU Registry Key
Suspicious Bash History Clearing for Anti-Forensics on Linux (via process_creation)
Pivot detection · T1070.003 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.