Sunturai
Back to results
InformationalSplunk security contentRaven Tait +1

Linux Shell History Access Via Command Line Utility

The following analytic detects attempts to read shell history files (bash, zsh, fish, etc.). A history file is a log file that records all the commands executed in a shell on a Linux or Unix-based operating system. A…

Description

The following analytic detects attempts to read shell history files (bash, zsh, fish, etc.). A history file is a log file that records all the commands executed in a shell on a Linux or Unix-based operating system. A malicious actor who gains access to a user's shell history file can potentially obtain sensitive information and use it to compromise the user's system and data.

Detection logic

Detection requirements

Platform
LinuxmacOSWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
sysmon_for_linux_eventid_1

Known benign triggers

  • Legitimate system administrators and automated scripts may access shell history files for auditing or troubleshooting purposes. Filter based on known administrative accounts and approved tooling in your environment.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice