T1070.003 Clear Command History
Sub-technique of T1070 Indicator Removal
In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done. On Linux and macOS, these command histories can be accessed in a few different ways. While logged in, this…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Cisco Clear Logshightest · cisco
- Clearing Windows Console Historyhightest · windows
- Disable Powershell Command Historyhightest · windows
- Linux Command History Tamperinghightest · linux
- RunMRU Registry Key Deletionhighexperimental · windows
- RunMRU Registry Key Deletion - Registryhighexperimental · windows
- Clear PowerShell History - PowerShellmediumtest · windows
- Clear PowerShell History - PowerShell Modulemediumtest · windows
- Suspicious IO.FileStreammediumtest · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.