Linux Command History Tampering

calendar Apr 17, 2024 · attack.defense_evasion attack.t1070.003  ·
Share on: linkedin copy

Detects commands that try to clear or tamper with the Linux command history. This technique is used by threat actors in order to evade defenses and execute commands without them being recorded in files such as "bash_history" or "zsh_history".

Sigma rule (View on GitHub)

 1title: Linux Command History Tampering
 2id: fdc88d25-96fb-4b7c-9633-c0e417fdbd4e
 3status: test
 4description: |
 5    Detects commands that try to clear or tamper with the Linux command history.
 6    This technique is used by threat actors in order to evade defenses and execute commands without them being recorded in files such as "bash_history" or "zsh_history".    
 7references:
 8    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.003/T1070.003.md
 9    - https://www.hackers-arise.com/post/2016/06/20/covering-your-bash-shell-tracks-antiforensics
10    - https://www.cadosecurity.com/spinning-yarn-a-new-linux-malware-campaign-targets-docker-apache-hadoop-redis-and-confluence/
11author: Patrick Bareiss
12date: 2019/03/24
13modified: 2024/04/17
14tags:
15    - attack.defense_evasion
16    - attack.t1070.003
17# Example config for this one (place it in .bash_profile):
18#  (is_empty=false; inotifywait -m .bash_history | while read file; do if [ $(wc -l <.bash_history) -lt 1  ]; then if  [ "$is_empty" = false ]; then logger -i -p local5.info -t empty_bash_history "$USER : ~/.bash_history is empty "; is_empty=true; fi; else is_empty=false;  fi;  done ) &
19#  It monitors the size of .bash_history and log the words "empty_bash_history" whenever a previously not empty bash_history becomes empty
20#  We define an empty file as a document with 0 or 1 lines (it can be a line with only one space character for example)
21#  It has two advantages over the version suggested by Patrick Bareiss  :
22#    - it is not relative to the exact command used to clear .bash_history : for instance Caldera uses "> .bash_history" to clear the history and this is not one the commands listed here. We can't be exhaustive for all the possibilities !
23#    - the method suggested by Patrick Bareiss logs all the commands entered directly in a bash shell. therefore it may miss some events (for instance it doesn't log the commands launched from a Caldera agent). Here if .bash_history is cleared, it will always be detected
24logsource:
25    product: linux
26detection:
27    keywords:
28        - 'cat /dev/null >*sh_history'
29        - 'cat /dev/zero >*sh_history'
30        - 'chattr +i*sh_history'
31        - 'echo "" >*sh_history'
32        - 'empty_bash_history'
33        - 'export HISTFILESIZE=0'
34        - 'history -c'
35        - 'history -w'
36        - 'ln -sf /dev/null *sh_history'
37        - 'ln -sf /dev/zero *sh_history'
38        - 'rm *sh_history'
39        - 'shopt -ou history'
40        - 'shopt -uo history'
41        - 'shred *sh_history'
42        - 'truncate -s0 *sh_history'
43        # - 'unset HISTFILE'  # prone to false positives
44    condition: keywords
45falsepositives:
46    - Unknown
47level: high

References

Related rules

to-top