Techniques › T1690
T1690 Prevent Command History Logging
defense impairment — ESXi, Linux, macOS, Network Devices, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
5
analytics
1
Sigma rules tagged attack.t1690
0
KEV CVEs mapped here
<p>Adversaries may impair command history logging to hide commands they run on a compromised system. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they have done.</p><p>On Linux and macOS, command history is tracked in a file pointed to by the environment variable
HISTFILE. When a user logs off a system, this information is flushed to a file in the user's home directory called ~/.bash_history. The HISTCONTROL environment variable keeps track of what should be saved by the history command and eventually into the ~/.bash_history file when a user logs out. HISTCONTROL does not exist by default on macOS, but can be set by the user and will be respected. The HISTFILE environment variable is also used in some ESXi systems.</p><p>Adversaries may clear the history environment variable (unset HISTFILE) or set the command history size to zero (export HISTFILESIZE=0) to prevent logging of commands. Additionally, HISTCONTROL can be configured to ignore commands that start with a space by simply setting it to "ignorespace". HISTCONTROL can also be set to ignore duplicate commands by setting it to "ignoredups". In some Linux systems, this is set by default to "ignoreboth" which covers both of the previous examples. This means that " ls" will not be saved, but "ls" would be saved by history. Adversaries can abuse this to operate without leaving traces by simply prepending a space to all of their terminal commands.</p><p>On Windows systems, the PSReadLine module tracks commands used in all PowerShell sessions and writes them to a file ($env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt by default). Adversaries may change where these logs are saved using Set-PSReadLineOption -HistorySavePath {File Path}. This will cause ConsoleHost_history.txt to stop receiving logs. Additionally, it is possible to turn off logging to this file using the PowerShell command Set-PSReadlineOption -HistorySaveStyle SaveNothing.</p><p>Adversaries may also leverage a Network Device CLI on network devices to disable historical command logging (e.g. no logging).</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0563 Detection Strategy for Defense Impairment via Prevent Command History Logging across OS platforms. v1.0
AN1555 LinuxDetection of environment variable tampering (HISTFILE, HISTCONTROL, HISTFILESIZE) and absence of expected bash history writes. Correlation of unset or zeroed history variables with active shell sessions is indicative of adversarial evasion.auditd:SYSCALL
execve calls modifying HISTFILE or HISTCONTROL via unset/export→ DC0064 Command Executionlinux:osqueryprocesses modifying environment variables related to history logging→ DC0032 Process CreationTunable:MonitoredUsersTimeWindowAN1556 macOSDetection of bash/zsh history suppression via HISTFILE/HISTCONTROL manipulation and absence of ~/.bash_history updates. Observing environment variable changes tied to terminal processes is a strong indicator.Tunable:ShellProfilesAN1557 WindowsDetection of PowerShell history suppression using Set-PSReadLineOption with SaveNothing or altered HistorySavePath. Correlating these options with PowerShell usage highlights adversarial evasion attempts.Tunable:AllowedPathsAN1558 ESXiDetection of unset HISTFILE or modified history variables in ESXi shell sessions. Correlation of suspicious shell sessions with no recorded commands despite active usage.Tunable:AdminSessionsAN1559 Network DevicesDetection of CLI commands that disable history logging such as 'no logging'. Anomalous lack of new commands in session logs while activity persists is a strong signal.networkdevice:cliCommands like 'no logging' or equivalents that disable session history→ DC0064 Command ExecutionTunable:DeviceVendors
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1690
Author: Cedric Maurugeon
· 2023-09-04 · logsource: product=linux category=process_creation · 38eb1dbb-011f-40b1-a126-cf03a0210563
Detects changes to the ESXi syslog configuration via "esxcli"