Techniques › T1690 › AN1555
AN1555 Analytic 1555
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detection of environment variable tampering (HISTFILE, HISTCONTROL, HISTFILESIZE) and absence of expected bash history writes. Correlation of unset or zeroed history variables with active shell sessions is indicative of adversarial evasion.</p>
- Detects
- T1690 Prevent Command History Logging
- Part of
- DET0563 Detection Strategy for Defense Impairment via Prevent Command History Logging across OS platforms.
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | execve calls modifying HISTFILE or HISTCONTROL via unset/export | DC0064 Command Execution |
| linux:osquery | processes modifying environment variables related to history logging | DC0032 Process Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
MonitoredUsers | Specific accounts or groups where history logging must always be enforced. |
TimeWindow | Correlation period to detect unset/export of history variables during active shells. |