Detect Clear Command History in Google Chronicle

rule t1070_003_clear_command_history {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects T1070.003 - Indicator Removal: Clear Command History. Covers PowerShell PSReadLine file manipulation, Linux shell history clearing commands (history -c), environment variable suppression (HISTFILE=, HISTSIZE=0, HISTFILESIZE=0), and direct deletion of .bash_history/.zsh_history files. Associated with TeamTNT, APT41, Aquatic Panda, Kobalos, and Medusa Group ransomware."
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "T1070.003"
    severity = "HIGH"
    confidence = "HIGH"
    version = "1.0"
    created = "2026-04-13"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      (
        /* PowerShell PSReadLine manipulation */
        re.regex($e.target.process.file.full_path, `(?i)(powershell\.exe|pwsh\.exe)$`)
        and
        (
          re.regex($e.target.process.command_line, `(?i)ConsoleHost_history`) or
          re.regex($e.target.process.command_line, `(?i)PSReadLine`) or
          re.regex($e.target.process.command_line, `(?i)Get-PSReadlineOption`) or
          re.regex($e.target.process.command_line, `(?i)Clear-History`) or
          re.regex($e.target.process.command_line, `(?i)Remove-Item.*[Hh]istory`)
        )
      )
      or
      (
        /* Linux shell history clearing */
        re.regex($e.target.process.file.full_path, `(?i)/(bash|sh|zsh|fish)$`)
        and
        (
          re.regex($e.target.process.command_line, `history\s+-[cw]`) or
          re.regex($e.target.process.command_line, `HISTFILE=`) or
          re.regex($e.target.process.command_line, `HISTSIZE=0`) or
          re.regex($e.target.process.command_line, `HISTFILESIZE=0`)
        )
      )
      or
      (
        /* Direct deletion of shell history files */
        re.regex($e.target.process.file.full_path, `(?i)/(rm|unlink|shred)$`)
        and
        (
          re.regex($e.target.process.command_line, `\.(bash|zsh|ash|fish)_history`) or
          re.regex($e.target.process.command_line, `ConsoleHost_history\.txt`)
        )
      )
      or
      (
        /* PowerShell HistorySavePath via Get-PSReadlineOption - Medusa Group TTP */
        re.regex($e.target.process.file.full_path, `(?i)(powershell\.exe|pwsh\.exe)$`) and
        re.regex($e.target.process.command_line, `(?i)HistorySavePath`)
      )
    )

  condition:
    $e
}