Detect Impair Command History Logging in IBM QRadar
Adversaries may impair command history logging to hide commands they run on a compromised system. On Linux and macOS, this involves manipulating HISTFILE, HISTFILESIZE, HISTSIZE, and HISTCONTROL environment variables, or redirecting history to /dev/null. On Windows, adversaries may modify PSReadLine settings to disable PowerShell command history. On network devices, adversaries may disable command logging entirely.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1562 Impair Defenses
- Sub-technique
- T1562.003 Impair Command History Logging
- Canonical reference
- https://attack.mitre.org/techniques/T1562/003/
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
sourceip,
username,
LOGSOURCENAME(logsourceid) AS log_source,
CATEGORYNAME(category) AS category_name,
"CommandLine",
CASE
WHEN "CommandLine" ILIKE '%unset HISTFILE%' OR "CommandLine" ILIKE '%HISTFILE=/dev/null%' THEN 'HISTFILE Disabled'
WHEN "CommandLine" ILIKE '%HISTFILESIZE=0%' OR "CommandLine" ILIKE '%HISTSIZE=0%' THEN 'History Size Zeroed'
WHEN "CommandLine" ILIKE '%HISTCONTROL%' THEN 'HISTCONTROL Modified'
WHEN "CommandLine" ILIKE '%history -c%' THEN 'History Cleared'
WHEN "CommandLine" ILIKE '%set +o history%' THEN 'History Disabled'
WHEN "CommandLine" ILIKE '%SaveNothing%' OR "CommandLine" ILIKE '%HistorySavePath%' THEN 'PSReadLine Tampered'
WHEN "CommandLine" ILIKE '%ConsoleHost_history%' THEN 'PS History File Deleted'
WHEN "CommandLine" ILIKE '%bash_history%' AND ("CommandLine" ILIKE '%rm %' OR "CommandLine" ILIKE '%truncate%' OR "CommandLine" ILIKE '%ln -sf%') THEN 'History File Deleted'
ELSE 'Other'
END AS tamper_method,
CASE
WHEN LOGSOURCETYPEID(logsourceid) = 12 THEN 'Windows'
WHEN LOGSOURCETYPEID(logsourceid) IN (71, 233, 352) THEN 'Linux/macOS'
ELSE 'Unknown'
END AS platform
FROM events
WHERE
starttime > NOW() - 1 DAYS
AND (
"CommandLine" ILIKE '%unset HISTFILE%'
OR "CommandLine" ILIKE '%HISTFILE=/dev/null%'
OR "CommandLine" ILIKE '%HISTFILESIZE=0%'
OR "CommandLine" ILIKE '%HISTSIZE=0%'
OR "CommandLine" ILIKE '%HISTCONTROL=ignoreboth%'
OR "CommandLine" ILIKE '%HISTCONTROL=ignorespace%'
OR "CommandLine" ILIKE '%set +o history%'
OR "CommandLine" ILIKE '%history -c%'
OR "CommandLine" ILIKE '%history -w /dev/null%'
OR "CommandLine" ILIKE '%Set-PSReadlineOption%SaveNothing%'
OR "CommandLine" ILIKE '%Set-PSReadLineOption%HistorySavePath%'
OR "CommandLine" ILIKE '%Remove-Item%ConsoleHost_history%'
OR "CommandLine" ILIKE '%del%ConsoleHost_history%'
OR ("CommandLine" ILIKE '%bash_history%'
AND ("CommandLine" ILIKE '%rm -%' OR "CommandLine" ILIKE '%truncate -s 0%' OR "CommandLine" ILIKE '%ln -sf /dev/null%'))
)
ORDER BY starttime DESCDetects command history tampering across Linux/macOS and Windows endpoints ingested into QRadar. Queries process execution logs for shell environment variable manipulation, history file deletion, and PSReadLine configuration changes that prevent command logging. Uses CommandLine field populated by Sysmon, auditd, or EDR integrations.
Data Sources
Required Tables
False Positives & Tuning
- Automated infrastructure-as-code tools (Ansible, Chef, Puppet) that set HISTCONTROL=ignorespace to avoid recording plaintext credentials passed as command arguments during provisioning
- Docker container initialization scripts that clear or redirect bash history as part of image build or ephemeral container startup to reduce attack surface
- Security teams running STIG compliance enforcement scripts that modify history settings as part of baseline hardening on managed Linux hosts
Other platforms for T1562.003
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Disable Bash History via HISTFILE
Expected signal: Auditd execve record for the shell session showing 'unset HISTFILE'. Process creation event in MDE. No bash_history entries will be written for subsequent commands.
- Test 2Redirect History to /dev/null (BPFDoor Pattern)
Expected signal: Auditd execve record. The process /proc/<PID>/environ will show HISTFILE=/dev/null.
- Test 3Disable PSReadLine History on Windows
Expected signal: Sysmon Event ID 1: powershell.exe with CommandLine containing 'Set-PSReadlineOption'. PowerShell ScriptBlock Log Event ID 4104.
References (5)
- https://attack.mitre.org/techniques/T1562/003/
- https://sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/
- https://www.cisa.gov/sites/default/files/publications/AA20-239A_Joint_Advisory.pdf
- https://learn.microsoft.com/en-us/powershell/module/psreadline/set-psreadlineoption
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.003/T1562.003.md
Unlock Pro Content
Get the full detection package for T1562.003 including response playbook, investigation guide, and atomic red team tests.