Detect Bash History in Microsoft Sentinel
Adversaries may search the command-line history on compromised systems for insecurely stored credentials. On Linux and macOS, shells like Bash and Zsh maintain history files (~/.bash_history, ~/.zsh_history) that capture all commands including those containing passwords passed as arguments. On Windows, PowerShell maintains a persistent history file at %USERPROFILE%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt. Users frequently type credentials as command-line arguments to tools like curl, ssh, mysql, psql, git, and aws CLI, which then persist in shell history. Kinsing malware is a known user of this technique to harvest credentials from containerized environments.
MITRE ATT&CK
- Tactic
- Credential Access
- Technique
- T1552 Unsecured Credentials
- Sub-technique
- T1552.003 Shell History
- Canonical reference
- https://attack.mitre.org/techniques/T1552/003/
KQL Detection Query
// Detect shell history file access for credential harvesting
DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileRead", "FileAccessed", "FileCreated")
| where (
// Linux/macOS shell history files
FileName in~ (".bash_history", ".zsh_history", ".sh_history", ".history",
".fish_history", ".ksh_history", ".csh_history")
or
// Windows PowerShell history
FileName =~ "ConsoleHost_history.txt"
or
// Linux history in various locations
FolderPath has ".bash_history" or FolderPath has ".zsh_history"
or FolderPath has "PSReadLine"
)
| where InitiatingProcessFileName !in~ ("bash", "zsh", "sh", "fish", "powershell", "pwsh", "sshd")
| project Timestamp, DeviceName, InitiatingProcessAccountName, FolderPath, FileName,
InitiatingProcessFileName, InitiatingProcessCommandLine
| union (
// Detect direct read/cat/type of history files via process command lines
DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any (
".bash_history", ".zsh_history", ".sh_history",
"ConsoleHost_history.txt", "PSReadLine", "Get-History"
)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName
)
| sort by Timestamp descDetects shell history file access for credential harvesting. Monitors file access to .bash_history, .zsh_history, .sh_history, and Windows PowerShell ConsoleHost_history.txt from unexpected processes (not the shells themselves). Also detects process command lines explicitly referencing history file paths (cat, type, more commands reading history files).
Data Sources
Required Tables
False Positives & Tuning
- Shell processes (bash, zsh, sh) legitimately reading their own history files at session start/end — this is normal behavior and should be excluded
- Backup agents reading home directories including shell history files as part of user data backup
- System administration scripts that process or rotate shell history files for compliance or auditing
- IDE and terminal applications that integrate with shell history for command completion features
- Security tools performing scheduled credential hygiene scans on behalf of users
Other platforms for T1552.003
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Read bash_history File for Credentials
Expected signal: Linux auditd EXECVE records for cat and grep with .bash_history path. OPEN syscall for .bash_history. Process chain visible in auditd records.
- Test 2Access Another User's bash_history
Expected signal: Linux auditd: SYSCALL with uid of calling user but auid of root for the cat command. OPEN syscall for /root/.bash_history. sudo usage logged in /var/log/auth.log.
- Test 3Read Windows PowerShell History
Expected signal: Sysmon Event ID 1: cmd.exe with 'type' and 'ConsoleHost_history.txt' in command line. Sysmon Event ID 11: file access for ConsoleHost_history.txt.
- Test 4Enumerate All Shell History Files on System
Expected signal: Linux auditd EXECVE for find with .bash_history pattern. Multiple OPEN syscalls for each discovered history file. Process chain showing find then cat.
References (7)
- https://attack.mitre.org/techniques/T1552/003/
- https://linux.die.net/man/1/bash
- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_history
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1552.003/T1552.003.md
- https://www.aquasec.com/blog/threat-alert-kinsing-malware-container-vulnerability/
- https://docs.microsoft.com/en-us/powershell/module/psreadline/
- https://objective-see.org/blog/blog_0x25.html
Unlock Pro Content
Get the full detection package for T1552.003 including response playbook, investigation guide, and atomic red team tests.