Tampering of Shell Command-Line History

Adversaries frequently target command-line history files, such as .bash_history and .zsh_history, to obscure their activities during unauthorized system access. By deleting history files, truncating them, or redirecting history logging to /dev/null, attackers prevent security teams from reconstructing their actions. This behavior involves the manipulation of specific environment variables like HISTFILE and HISTFILESIZE, which govern logging persistence. Defending against this requires monitoring process execution for common utilities - such as rm, echo, truncate, unset, and export - when invoked against history files or history configuration parameters. This threat affects both Linux and macOS environments and is a standard technique used across various post-exploitation scenarios to ensure stealth.

Attack Chain

1. Attacker gains initial access to a Linux or macOS host.
2. Attacker executes shell commands or scripts to perform reconnaissance or lateral movement.
3. Attacker identifies the target shell history file (e.g., ~/.bash_history).
4. Attacker attempts to disable future logging by setting HISTFILE to /dev/null or HISTFILESIZE to 0.
5. Attacker clears current session history by executing 'history -c'.
6. Attacker deletes or overwrites existing history files using commands like 'rm' or 'truncate -s0'.
7. Attacker continues malicious activities, knowing that subsequent commands will not be recorded in the local history files.

Impact

Successful tampering with shell history prevents security teams from conducting accurate forensic analysis after a breach. This complicates the identification of compromised credentials, the scope of exfiltration, and the persistence mechanisms used by the attacker, effectively granting the adversary extended dwell time and making incident response significantly more difficult.

Recommendation

Prioritize monitoring for command-line arguments that signal tampering attempts.

• Deploy the provided Sigma rules to identify attempts to manipulate shell environment variables and history files.
• Implement strict auditing (e.g., auditd) to track all modifications to sensitive shell history files located in /root, /home/, and /Users/ directories.
• Use centralized logging to forward shell history data in real-time, which mitigates the risk of local tampering.
• Establish alerting for the execution of 'export HISTFILE=/dev/null' or 'history -c' across the environment.