Clear Command History
In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done. On Linux and macOS, these command histories can be accessed in a few different ways. While logged in, this command history is tracked in a file pointed to by the environment variable <code>HISTFILE</code>. Whe...
BY SOURCE
PROCEDURES (8)
Auto-extracted: 4 detections for general monitoring
Auto-extracted: 3 detections for powershell
Auto-extracted: 2 detections for script execution monitoring
Auto-extracted: 1 detections for registry
Auto-extracted: 1 detections for evasion
Auto-extracted: 1 detections for evasion
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for registry