AN1555
Analytic 1555
Linux
Detection of environment variable tampering (HISTFILE, HISTCONTROL, HISTFILESIZE) and absence of expected bash history writes. Correlation of unset or zeroed history variables with active shell sessions is indicative of adversarial evasion.
auditd:SYSCALL
execve calls modifying HISTFILE or HISTCONTROL via unset/export
linux:osquery
processes modifying environment variables related to history logging
[MonitoredUsers]
Specific accounts or groups where history logging must always be enforced.
[TimeWindow]
Correlation period to detect unset/export of history variables during active shells.
AN1556
Analytic 1556
macOS
Detection of bash/zsh history suppression via HISTFILE/HISTCONTROL manipulation and absence of ~/.bash_history updates. Observing environment variable changes tied to terminal processes is a strong indicator.
macos:unifiedlog
Set or unset HIST* variables in shell environment
[ShellProfiles]
Different shells (bash, zsh, fish) may require customized monitoring for history tampering.
AN1557
Analytic 1557
Windows
Detection of PowerShell history suppression using Set-PSReadLineOption with SaveNothing or altered HistorySavePath. Correlating these options with PowerShell usage highlights adversarial evasion attempts.
WinEventLog:PowerShell
EventCode=4103, 4104, 4105, 4106
WinEventLog:Sysmon
EventCode=1
[AllowedPaths]
List of acceptable PowerShell history save paths for baseline comparison.
AN1558
Analytic 1558
ESXi
Detection of unset HISTFILE or modified history variables in ESXi shell sessions. Correlation of suspicious shell sessions with no recorded commands despite active usage.
esxi:shell
unset HISTFILE or HISTFILESIZE modifications
[AdminSessions]
Differentiate root/admin shell sessions from adversarial misuse of ESXi shell.
AN1559
Analytic 1559
Network Devices
Detection of CLI commands that disable history logging such as 'no logging'. Anomalous lack of new commands in session logs while activity persists is a strong signal.
networkdevice:cli
Commands like 'no logging' or equivalents that disable session history
[DeviceVendors]
Command syntax differs across Cisco, Juniper, Fortinet, etc., requiring vendor-aware tuning.