Detect Clear Command History in Microsoft Sentinel
Adversaries clear command history to conceal actions taken during an intrusion. On Windows, PowerShell maintains two history stores: the in-session history (cleared by Clear-History) and the PSReadLine history file at %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt. Attackers may delete or truncate this file or use Remove-Item (Get-PSReadlineOption).HistorySavePath — the method used by Medusa Group ransomware. On Linux/macOS, history -c clears the in-memory history, HISTFILE= unsets the history file, and rm ~/.bash_history deletes the persistent record. Setting HISTSIZE=0 or HISTFILESIZE=0 prevents future history recording. TeamTNT, Aquatic Panda, APT41, Kobalos, and APT5 (ESXi) have all been observed clearing command history as post-exploitation cleanup.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1070 Indicator Removal
- Sub-technique
- T1070.003 Clear Command History
- Canonical reference
- https://attack.mitre.org/techniques/T1070/003/
KQL Detection Query
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (
// PowerShell history file deletion or manipulation
(FileName in~ ("powershell.exe", "pwsh.exe")
and ProcessCommandLine has_any ("ConsoleHost_history", "PSReadLine", "Get-PSReadlineOption", "Clear-History", "Remove-Item"))
or
// Linux/macOS bash history clearing via shell
(FileName in~ ("bash", "sh", "zsh", "fish")
and ProcessCommandLine has_any ("history -c", "history -w", "HISTFILE=", "HISTSIZE=0", "HISTFILESIZE=0"))
or
// Direct deletion of history files
(ProcessCommandLine has_any ("bash_history", ".zsh_history", ".ash_history", ".fish_history")
and ProcessCommandLine has_any ("rm ", "del ", "Remove-Item", "unlink"))
)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc
| union (
DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileDeleted", "FileModified")
| where FolderPath has_any ("PSReadLine", "ConsoleHost_history")
or FileName in~ (".bash_history", ".zsh_history", ".ash_history")
| project Timestamp, DeviceName, InitiatingProcessAccountName,
FileName, FolderPath, ActionType, InitiatingProcessFileName
)
| sort by Timestamp descDetects command history clearing across Windows and Linux/macOS platforms. Layer 1: PowerShell process events where the command line references PSReadLine history file operations or uses Clear-History cmdlet. Layer 2: Shell process events (bash/sh/zsh) with history -c or HISTSIZE=0 patterns. Layer 3: DeviceFileEvents for direct deletion or modification of history files including ConsoleHost_history.txt and .bash_history. The union approach catches both process-level commands and file-level deletions.
Data Sources
Required Tables
False Positives & Tuning
- Administrators running Clear-History during interactive PowerShell sessions for legitimate housekeeping
- Shell profile scripts that set HISTSIZE=0 for service accounts that should not record history
- Backup or rotation scripts that delete and recreate .bash_history files
- Security tools that sanitize history files after removing credentials accidentally typed at the command line
Other platforms for T1070.003
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Clear PowerShell PSReadLine History File
Expected signal: Sysmon EventCode 23 (FileDelete) targeting %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt. PowerShell process creation event with Remove-Item and Get-PSReadlineOption in the command line. MDE DeviceFileEvents with ActionType=FileDeleted for the history file path.
- Test 2Truncate PowerShell History via Clear-History and Set-Content
Expected signal: PowerShell process creation with Set-Content and Get-PSReadlineOption. Sysmon EventCode 11 (FileCreate) or EventCode 15 on the ConsoleHost_history.txt file (file write). MDE DeviceFileEvents with ActionType=FileModified targeting the PSReadLine history path.
- Test 3Clear Linux Bash History and Disable Future Recording
Expected signal: Shell process execution with history -c, rm ~/.bash_history in command arguments. Linux audit daemon EXECVE records for each command in the chain. DeviceFileEvents (if MDE Linux agent deployed) with FileDeleted for .bash_history. Process command line will include HISTSIZE=0 in environment modification.
References (5)
- https://attack.mitre.org/techniques/T1070/003/
- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_history
- https://community.sophos.com/sophos-labs/b/blog/posts/powershell-command-history-forensics
- https://knowledge.broadcom.com/external/article/321910/auditing-esxi-shell-logins-and-commands.html
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.003/T1070.003.md
Unlock Pro Content
Get the full detection package for T1070.003 including response playbook, investigation guide, and atomic red team tests.