Skip to content
Permalink
Branch: master
Find file Copy path
Find file Copy path
1 contributor

Users who have contributed to this file

23 lines (17 sloc) 1.27 KB

T1148 - HISTCONTROL

Description from ATT&CK

The HISTCONTROL environment variable keeps track of what should be saved by the history command and eventually into the ~/.bash_history file when a user logs out. This setting can be configured to ignore commands that start with a space by simply setting it to "ignorespace". HISTCONTROL can also be set to ignore duplicate commands by setting it to "ignoredups". In some Linux systems, this is set by default to "ignoreboth" which covers both of the previous examples. This means that “ ls” will not be saved, but “ls” would be saved by history. HISTCONTROL does not exist by default on macOS, but can be set by the user and will be respected. Adversaries can use this to operate without leaving traces by simply prepending a space to all of their terminal commands.

How to Detect

Simulating the attack

export HISTCONTROL=ignoreboth

Data sources required to detect the attack

bash_history logs

Splunk Queries to detect the attack

bash_history

index=linux sourcetype="bash_history" export HISTCONTROL | table host, user_name, bash_command

Caution

Note:

You can’t perform that action at this time.