Prevent Command History Logging T1690
Tactic: Defense Impairment
Adversaries may impair command history logging to hide commands they run on a compromised system. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they have done.
Events covered
1 catalog event is tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Sysmon-for-Linux | Event ID 1 | Process Create |
Authoring guide
These 4 rules share fields, values, and exclusions.
Fields filtered most (6 distinct)
These fields appear most often in rule filters.
Top indicator values (14 distinct)
These values appear most often in rule predicates.
Exclusions (1 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.