Detection rules › Splunk
Clear Command History
An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. macOS and Linux both keep track of the commands users type in their terminal so that users can retrace what they've done
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth |
References
Telemetry coverage
Rule body
id: '5381.5491'
title: Clear Command History
description: 'An adversary may clear the command history of a compromised account
to conceal the actions undertaken during an intrusion. macOS and Linux both keep
track of the commands users type in their terminal so that users can retrace what
they''ve done. Atomics T1070.003 Test #1 Atomics T1070.003 Test #3 Atomics T1070.003
Test #6 Atomics T1070.003 Test #7'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_unix` (type=proctitle OR type=execve
OR sourcetype=bash_history) AND ((TERM(unset) AND TERM(HISTFILE)) OR (TERM(export)
AND (TERM(HISTSIZE) OR TERM(HISTFILESIZE) OR TERM(HISTFILE)) AND (TERM(0) OR "/dev/null"))
OR (TERM(history) AND ((TERM(-c) OR TERM(-cw) OR TERM(-d)) OR (TERM(set) AND TERM(+o))
OR (TERM(shopt) AND (TERM(-ou) OR (TERM(-o) AND TERM(-u)))))) OR (("HISTSIZE" OR
"HISTFILESIZE") AND "0") OR ((TERM(rm) OR ((TERM(cat) OR TERM(ln)) AND "/dev/null"))
OR ((TERM(echo) OR TERM(truncate)) AND TERM(bash_history)))) | rex field=_raw "(?i)proctitle=(\")?(?<proc>.+")|
eval process=mvappend(process, proc)| regex process="((unset\s+HISTFILE)|(export\s+HIST(FILE|SIZE|FILEZIE).+(0|\/dev\/null))|(history\s+\-(c|cw|d\s+\d+))|(set\s+\+o\s+history)|(shopt\s+(\-ou|\-o\s+\-u|\-u\s+\-o)\s+history)|((HISTSIZE|HISTFILESIZE)\=0)|((rm|cat\s+\/dev\/null\s+\>|cat\s+\>).+\Q.bash_history\E))|(((echo\s+\"\"\s+>)|(ln\s+.+?\s+/dev/null)|(truncate))\s+.+?\Q.bash_history\E)"
| table _time, host, user process, process_* | bin span=1s | stats values(*) as
* by _time, host '
techniques:
- defense-evasion:indicator removal:clear command history
technique_id:
- T1070.003
data_category:
- Process command-line parameters
- Linux audit logs
references:
- https://www.countercraftsec.com/blog/post/new-threat-actor-alert-unc0628/
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_unix` (type=proctitle OR type=execve OR sourcetype=bash_history) AND ((TERM(unset) AND TERM(HISTFILE)) OR (TERM(export) AND (TERM(HISTSIZE) OR TERM(HISTFILESIZE) OR TERM(HISTFILE)) AND (TERM(0) OR "/dev/null")) OR (TERM(history) AND ((TERM(-c) OR TERM(-cw) OR TERM(-d)) OR (TERM(set) AND TERM(+o)) OR (TERM(shopt) AND (TERM(-ou) OR (TERM(-o) AND TERM(-u)))))) OR (("HISTSIZE" OR "HISTFILESIZE") AND "0") OR ((TERM(rm) OR ((TERM(cat) OR TERM(ln)) AND "/dev/null")) OR ((TERM(echo) OR TERM(truncate)) AND TERM(bash_history))))
Stage 2: rex
| rex field=_raw "(?i)proctitle=(\")?(?<proc>.+")
Stage 3: eval
| eval process=mvappend(process, proc)
Stage 4: regex
| regex process="((unset\s+HISTFILE)|(export\s+HIST(FILE|SIZE|FILEZIE).+(0|\/dev\/null))|(history\s+\-(c|cw|d\s+\d+))|(set\s+\+o\s+history)|(shopt\s+(\-ou|\-o\s+\-u|\-u\s+\-o)\s+history)|((HISTSIZE|HISTFILESIZE)\=0)|((rm|cat\s+\/dev\/null\s+\>|cat\s+\>).+\Q.bash_history\E))|(((echo\s+\"\"\s+>)|(ln\s+.+?\s+/dev/null)|(truncate))\s+.+?\Q.bash_history\E)"
Stage 5: table
| table _time, host, user process, process_*
Stage 6: bucket
| bin span=1s
Stage 7: stats
| stats values(*) as * by _time, host
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
process | regex_match |
| field:"CommandLine" kind:regex_match |
sourcetype | eq |
| field:"sourcetype" kind:eq value:"bash_history" |
type | eq |
| field:"type" kind:eq |
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | unset |
| 1 | HISTFILE |
| 1 | export |
| 1 | HISTSIZE |
| 1 | HISTFILESIZE |
| 1 | HISTFILE |
| 1 | 0 |
| 1 | "/dev/null" |
| 1 | history |
| 1 | "-c" |
| 1 | "-cw" |
| 1 | "-d" |
| 1 | set |
| 1 | "+o" |
| 1 | shopt |
| 1 | "-ou" |
| 1 | "-o" |
| 1 | "-u" |
| 1 | "HISTSIZE" |
| 1 | "HISTFILESIZE" |
| 1 | "0" |
| 1 | rm |
| 1 | cat |
| 1 | ln |
| 1 | "/dev/null" |
| 1 | echo |
| 1 | truncate |
| 1 | bash_history |