Detect Clear Command History in IBM QRadar
Adversaries clear command history to conceal actions taken during an intrusion. On Windows, PowerShell maintains two history stores: the in-session history (cleared by Clear-History) and the PSReadLine history file at %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt. Attackers may delete or truncate this file or use Remove-Item (Get-PSReadlineOption).HistorySavePath — the method used by Medusa Group ransomware. On Linux/macOS, history -c clears the in-memory history, HISTFILE= unsets the history file, and rm ~/.bash_history deletes the persistent record. Setting HISTSIZE=0 or HISTFILESIZE=0 prevents future history recording. TeamTNT, Aquatic Panda, APT41, Kobalos, and APT5 (ESXi) have all been observed clearing command history as post-exploitation cleanup.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1070 Indicator Removal
- Sub-technique
- T1070.003 Clear Command History
- Canonical reference
- https://attack.mitre.org/techniques/T1070/003/
QRadar Detection Query
SELECT
DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
logsourcename(logsourceid) AS LogSource,
username,
sourceip,
QIDNAME(qid) AS EventName,
"Process Name",
"Command",
CATEGORYNAME(category) AS Category
FROM events
WHERE
LOGSOURCETYPEID(logsourceid) IN (12, 13, 311, 352)
AND devicetime > (CURRENT_TIMESTAMP - 86400000)
AND (
/* PowerShell PSReadLine manipulation */
(
LOWER("Process Name") LIKE '%powershell.exe'
OR LOWER("Process Name") LIKE '%pwsh.exe'
) AND (
LOWER("Command") LIKE '%consolehost_history%'
OR LOWER("Command") LIKE '%psreadline%'
OR LOWER("Command") LIKE '%get-psreadlineoption%'
OR LOWER("Command") LIKE '%clear-history%'
OR LOWER("Command") LIKE '%remove-item%history%'
)
OR
/* Linux shell history clearing */
(
LOWER("Process Name") IN ('bash', 'sh', 'zsh', 'fish')
AND (
LOWER("Command") LIKE '%history -c%'
OR LOWER("Command") LIKE '%histfile=%'
OR LOWER("Command") LIKE '%histsize=0%'
OR LOWER("Command") LIKE '%histfilesize=0%'
)
)
OR
/* Direct deletion of history files */
(
LOWER("Process Name") IN ('rm', 'unlink', 'shred', 'del')
AND (
LOWER("Command") LIKE '%.bash_history%'
OR LOWER("Command") LIKE '%.zsh_history%'
OR LOWER("Command") LIKE '%.ash_history%'
OR LOWER("Command") LIKE '%.fish_history%'
)
)
)
ORDER BY devicetime DESC
LIMIT 1000Detects T1070.003 command history clearing in QRadar using process execution events from Windows Sysmon, Windows Security audit logs, and Linux auditd. Covers PowerShell PSReadLine manipulation, shell history clearing commands, environment variable suppression of history recording, and direct deletion of history files across Windows and Linux endpoints.
Data Sources
Required Tables
False Positives & Tuning
- Security operations personnel manually clearing history after conducting forensic analysis on a host
- Automated provisioning scripts that configure PSReadLine options for service accounts during system hardening
- Developer workstations where shell profile scripts clear history as a privacy preference
Other platforms for T1070.003
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Clear PowerShell PSReadLine History File
Expected signal: Sysmon EventCode 23 (FileDelete) targeting %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt. PowerShell process creation event with Remove-Item and Get-PSReadlineOption in the command line. MDE DeviceFileEvents with ActionType=FileDeleted for the history file path.
- Test 2Truncate PowerShell History via Clear-History and Set-Content
Expected signal: PowerShell process creation with Set-Content and Get-PSReadlineOption. Sysmon EventCode 11 (FileCreate) or EventCode 15 on the ConsoleHost_history.txt file (file write). MDE DeviceFileEvents with ActionType=FileModified targeting the PSReadLine history path.
- Test 3Clear Linux Bash History and Disable Future Recording
Expected signal: Shell process execution with history -c, rm ~/.bash_history in command arguments. Linux audit daemon EXECVE records for each command in the chain. DeviceFileEvents (if MDE Linux agent deployed) with FileDeleted for .bash_history. Process command line will include HISTSIZE=0 in environment modification.
References (5)
- https://attack.mitre.org/techniques/T1070/003/
- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_history
- https://community.sophos.com/sophos-labs/b/blog/posts/powershell-command-history-forensics
- https://knowledge.broadcom.com/external/article/321910/auditing-esxi-shell-logins-and-commands.html
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.003/T1070.003.md
Unlock Pro Content
Get the full detection package for T1070.003 including response playbook, investigation guide, and atomic red team tests.