detection.wiki

Detection rules › Sigma

Linux Command History Tampering

Status
test
Severity
high
Log source
product linux
Author
Patrick Bareiss
Source
github.com/SigmaHQ/sigma

Detects commands that try to clear or tamper with the Linux command history. This technique is used by threat actors in order to evade defenses and execute commands without them being recorded in files such as "bash_history" or "zsh_history".

MITRE ATT&CK coverage

TacticTechniques
StealthT1070.003 Indicator Removal: Clear Command History

Rule body yaml

title: Linux Command History Tampering
id: fdc88d25-96fb-4b7c-9633-c0e417fdbd4e
status: test
description: |
    Detects commands that try to clear or tamper with the Linux command history.
    This technique is used by threat actors in order to evade defenses and execute commands without them being recorded in files such as "bash_history" or "zsh_history".
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.003/T1070.003.md
    - https://www.hackers-arise.com/post/2016/06/20/covering-your-bash-shell-tracks-antiforensics
    - https://www.cadosecurity.com/spinning-yarn-a-new-linux-malware-campaign-targets-docker-apache-hadoop-redis-and-confluence/
author: Patrick Bareiss
date: 2019-03-24
modified: 2024-04-17
tags:
    - attack.stealth
    - attack.t1070.003
logsource:
    product: linux
detection:
    keywords:
        - 'cat /dev/null >*sh_history'
        - 'cat /dev/zero >*sh_history'
        - 'chattr +i*sh_history'
        - 'echo "" >*sh_history'
        - 'empty_bash_history'
        - 'export HISTFILESIZE=0'
        - 'history -c'
        - 'history -w'
        - 'ln -sf /dev/null *sh_history'
        - 'ln -sf /dev/zero *sh_history'
        - 'rm *sh_history'
        - 'shopt -ou history'
        - 'shopt -uo history'
        - 'shred *sh_history'
        - 'truncate -s0 *sh_history'
        # - 'unset HISTFILE'  # prone to false positives
    condition: keywords
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

keywords

Stage 1: keywords

keywords:
    - 'cat /dev/null >*sh_history'
    - 'cat /dev/zero >*sh_history'
    - 'chattr +i*sh_history'
    - 'echo "" >*sh_history'
    - 'empty_bash_history'
    - 'export HISTFILESIZE=0'
    - 'history -c'
    - 'history -w'
    - 'ln -sf /dev/null *sh_history'
    - 'ln -sf /dev/zero *sh_history'
    - 'rm *sh_history'
    - 'shopt -ou history'
    - 'shopt -uo history'
    - 'shred *sh_history'
    - 'truncate -s0 *sh_history'