Sigma rule: Linux Command History Tampering

Rule

Title

Linux Command History Tampering

Status

test

Level

high

Author

Patrick Bareiss

Date

2019-03-24

Modified

2024-04-17

File

rules/linux/builtin/lnx_shell_clear_cmd_history.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects commands that try to clear or tamper with the Linux command history.
This technique is used by threat actors in order to evade defenses and execute commands without them being recorded in files such as "bash_history" or "zsh_history".

Log source

product

linux

Detection

keywords:
    - 'cat /dev/null >*sh_history'
    - 'cat /dev/zero >*sh_history'
    - 'chattr +i*sh_history'
    - 'echo "" >*sh_history'
    - 'empty_bash_history'
    - 'export HISTFILESIZE=0'
    - 'history -c'
    - 'history -w'
    - 'ln -sf /dev/null *sh_history'
    - 'ln -sf /dev/zero *sh_history'
    - 'rm *sh_history'
    - 'shopt -ou history'
    - 'shopt -uo history'
    - 'shred *sh_history'
    - 'truncate -s0 *sh_history'
    # - 'unset HISTFILE'  # prone to false positives
condition: keywords

False positives (as the rule lists them)

• Unknown

Tags

• attack.stealth
• attack.t1070.003

MITRE ATT&CK ids this rule names

• T1070.003

References

• https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.003/T1070.003.md
• https://www.hackers-arise.com/post/2016/06/20/covering-your-bash-shell-tracks-antiforensics
• https://www.cadosecurity.com/spinning-yarn-a-new-linux-malware-campaign-targets-docker-apache-hadoop-redis-and-confluence/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/linux/builtin/lnx_shell_clear_cmd_history.yml