Detection of Unauthorized Shell History File Access on Linux

This threat brief focuses on the post-exploitation technique of reading Linux shell history files (such as .bash_history, .zsh_history, and .fish_history) to gather sensitive information. Threat actors frequently target these files to recover plain-text credentials, configuration secrets, or to perform reconnaissance on system administration patterns. Access is typically achieved using standard system utilities like 'cat', 'tail', 'less', or text editors like 'vi' and 'vim'. Because these files are log-like, they are a high-value target for attackers attempting to pivot from initial access to privilege escalation or persistence. Defenders should monitor for process executions that attempt to read these specific history files to identify unauthorized user or service account activity.

Attack Chain

1. Attacker gains initial access to a Linux host (via SSH, web vulnerability, or phishing).
2. Attacker performs local enumeration of the current user's home directory.
3. Attacker identifies the existence of shell history files (.bash_history, .zhistory, etc.).
4. Attacker uses native binaries like 'cat' or 'less' to output the file contents to the terminal.
5. Attacker captures the output for offline analysis or uses grep/strings to search for keywords (e.g., password).
6. Attacker leverages discovered credentials to escalate privileges or move laterally to other systems.

Impact

Successful extraction of shell history files leads to the compromise of credentials and sensitive configuration data, potentially resulting in full system takeover or further propagation of the attack across the environment. This technique is observed across all Linux-based server environments and is frequently associated with post-exploitation phases where an attacker seeks to deepen their presence.

Recommendation

Deploy the provided Sigma rule to your SIEM to monitor for unauthorized access to history files. Filter the detection logic for known administrative service accounts and approved automation scripts to reduce false positives. Ensure Sysmon for Linux or equivalent EDR telemetry is configured to capture full command-line arguments and parent process information.