Techniques › T1552.003 › AN1086
AN1086 Analytic 1086
macOS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>A process or terminal command outside of standard shell utilities reads the user's .bash_history file. On macOS, unified logs or telemetry tools like EndpointSecurity (ESF) may observe file read APIs or terminal process lineage that shows non-user-initiated access.</p>
- Detects
- T1552.003 Shell History
- Part of
- DET0385 Detect Access and Parsing of .bash_history Files for Credential Harvesting
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| macos:endpointsecurity | open or read syscall to ~/.bash_history | DC0055 File Access |
| macos:unifiedlog | non-shell process tree accessing bash history | DC0034 Process Metadata |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
ParentProcessCheck | Scope access to .bash_history only if parent is not Terminal.app or bash/zsh |
AccessFrequency | Raise priority if .bash_history is accessed multiple times in short window |