Detect Clear Command History in Elastic Security
Adversaries clear command history to conceal actions taken during an intrusion. On Windows, PowerShell maintains two history stores: the in-session history (cleared by Clear-History) and the PSReadLine history file at %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt. Attackers may delete or truncate this file or use Remove-Item (Get-PSReadlineOption).HistorySavePath — the method used by Medusa Group ransomware. On Linux/macOS, history -c clears the in-memory history, HISTFILE= unsets the history file, and rm ~/.bash_history deletes the persistent record. Setting HISTSIZE=0 or HISTFILESIZE=0 prevents future history recording. TeamTNT, Aquatic Panda, APT41, Kobalos, and APT5 (ESXi) have all been observed clearing command history as post-exploitation cleanup.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1070 Indicator Removal
- Sub-technique
- T1070.003 Clear Command History
- Canonical reference
- https://attack.mitre.org/techniques/T1070/003/
Elastic Detection Query
sequence by host.id with maxspan=5m
[
any where (
(
process.name in~ ("powershell.exe", "pwsh.exe") and
(
process.args : "*ConsoleHost_history*" or
process.args : "*PSReadLine*" or
process.args : "*Get-PSReadlineOption*" or
process.args : "*Clear-History*" or
process.command_line : "*Remove-Item*history*"
)
) or
(
process.name in~ ("bash", "sh", "zsh", "fish") and
(
process.args : "*history -c*" or
process.args : "*HISTFILE=*" or
process.args : "*HISTSIZE=0*" or
process.args : "*HISTFILESIZE=0*" or
process.command_line : "*rm*bash_history*" or
process.command_line : "*rm*zsh_history*"
)
) or
(
process.name in~ ("rm", "unlink", "shred") and
(
process.args : "*.bash_history*" or
process.args : "*.zsh_history*" or
process.args : "*.ash_history*" or
process.args : "*.fish_history*"
)
)
)
]
| head 500Detects command history clearing on Windows and Linux/macOS. Covers PowerShell PSReadLine history file manipulation via Remove-Item or Clear-History, Linux shell history clearing via history -c, HISTFILE/HISTSIZE/HISTFILESIZE environment variable suppression, and direct deletion of .bash_history, .zsh_history, .ash_history, and .fish_history files using rm/unlink/shred.
Data Sources
Required Tables
False Positives & Tuning
- System administrators running history -c as part of legitimate hardening or cleanup scripts after privileged maintenance windows
- Automation or CI/CD pipelines invoking PowerShell that manipulate PSReadLine options for non-interactive sessions
- Security tooling or EDR agents performing history file management as part of normal telemetry collection
Other platforms for T1070.003
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Clear PowerShell PSReadLine History File
Expected signal: Sysmon EventCode 23 (FileDelete) targeting %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt. PowerShell process creation event with Remove-Item and Get-PSReadlineOption in the command line. MDE DeviceFileEvents with ActionType=FileDeleted for the history file path.
- Test 2Truncate PowerShell History via Clear-History and Set-Content
Expected signal: PowerShell process creation with Set-Content and Get-PSReadlineOption. Sysmon EventCode 11 (FileCreate) or EventCode 15 on the ConsoleHost_history.txt file (file write). MDE DeviceFileEvents with ActionType=FileModified targeting the PSReadLine history path.
- Test 3Clear Linux Bash History and Disable Future Recording
Expected signal: Shell process execution with history -c, rm ~/.bash_history in command arguments. Linux audit daemon EXECVE records for each command in the chain. DeviceFileEvents (if MDE Linux agent deployed) with FileDeleted for .bash_history. Process command line will include HISTSIZE=0 in environment modification.
References (5)
- https://attack.mitre.org/techniques/T1070/003/
- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_history
- https://community.sophos.com/sophos-labs/b/blog/posts/powershell-command-history-forensics
- https://knowledge.broadcom.com/external/article/321910/auditing-esxi-shell-logins-and-commands.html
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.003/T1070.003.md
Unlock Pro Content
Get the full detection package for T1070.003 including response playbook, investigation guide, and atomic red team tests.