Which SIEM platforms have a T1690 detection rule?

df00tech provides T1690 (Impair Command History Logging) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Impair Command History Logging (T1690)?

Detecting Impair Command History Logging requires the following data sources: Process: Process Creation, Command: Command Execution, Sensor Health: Host Status.

What severity and confidence is the T1690 detection?

The T1690 detection is rated medium severity with medium confidence.

What are common false positives for T1690?

Common false positives for T1690 include: Developers or sysadmins who habitually set HISTCONTROL=ignorespace for convenience when typing sensitive commands (e.g., inline passwords); Automated provisioning or hardening scripts that configure shell history settings as part of baseline configuration; Docker container entrypoint scripts that disable history logging in ephemeral environments.

T1690

Impair Command History Logging

Defense Impairment Last updated: April 21, 2026

Adversaries may impair command history logging to hide commands they run on a compromised system. On Linux and macOS, this involves manipulating HISTFILE, HISTFILESIZE, HISTSIZE, and HISTCONTROL environment variables, or redirecting history to /dev/null. On Windows, adversaries may modify PSReadLine settings to disable PowerShell command history. On network devices, adversaries may disable command logging entirely.

What is T1690 Impair Command History Logging?

Impair Command History Logging (T1690) maps to the Defense Impairment tactic — the adversary is trying to break security mechanisms, pipelines, and tooling so defenders can’t see or trust what’s happening in MITRE ATT&CK.

This page provides production-ready detection logic for Impair Command History Logging, covering the data sources and telemetry it touches: Process: Process Creation, Command: Command Execution, Sensor Health: Host Status. The queries below are rated medium severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic: Defense Impairment
Technique: T1690 Prevent Command History Logging
Canonical reference: https://attack.mitre.org/techniques/T1690/

Microsoft Sentinel / Defender

kusto

let HistoryTampering = dynamic(["unset HISTFILE", "export HISTFILE=/dev/null", "export HISTFILESIZE=0", "export HISTSIZE=0", "HISTCONTROL=ignoreboth", "HISTCONTROL=ignorespace", "set +o history", "history -c", "history -w /dev/null", "rm -f ~/.bash_history", "truncate -s 0", "ln -sf /dev/null", "Set-PSReadlineOption -HistorySaveStyle SaveNothing", "Set-PSReadLineOption -HistorySavePath", "Remove-Item*ConsoleHost_history.txt", "del*ConsoleHost_history.txt"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any (HistoryTampering)
| extend Platform = case(
    ProcessCommandLine has_any ("PSReadline", "ConsoleHost_history"), "Windows",
    ProcessCommandLine has_any ("HISTFILE", "bash_history", "history -c", "set +o history"), "Linux/macOS",
    "Unknown")
| extend TamperMethod = case(
    ProcessCommandLine has "unset HISTFILE" or ProcessCommandLine has "HISTFILE=/dev/null", "HISTFILE Disabled",
    ProcessCommandLine has "HISTFILESIZE=0" or ProcessCommandLine has "HISTSIZE=0", "History Size Zeroed",
    ProcessCommandLine has "HISTCONTROL", "HISTCONTROL Modified",
    ProcessCommandLine has "history -c", "History Cleared",
    ProcessCommandLine has "set +o history", "History Disabled",
    ProcessCommandLine has "rm" or ProcessCommandLine has "truncate" or ProcessCommandLine has "ln -sf /dev/null", "History File Deleted/Redirected",
    ProcessCommandLine has "SaveNothing", "PSReadLine Disabled",
    ProcessCommandLine has "HistorySavePath", "PSReadLine Redirected",
    ProcessCommandLine has "ConsoleHost_history", "PS History File Deleted",
    "Other")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, Platform, TamperMethod, InitiatingProcessFileName
| sort by Timestamp desc

Detects command history tampering on both Linux/macOS (HISTFILE, HISTCONTROL, bash_history manipulation) and Windows (PSReadLine settings, ConsoleHost_history.txt deletion). Uses MDE DeviceProcessEvents to monitor process command lines for history impairment patterns.

medium severity medium confidence

Data Sources

Process: Process Creation Command: Command Execution Sensor Health: Host Status

Required Tables

DeviceProcessEvents

False Positives

Developers or sysadmins who habitually set HISTCONTROL=ignorespace for convenience when typing sensitive commands (e.g., inline passwords)
Automated provisioning or hardening scripts that configure shell history settings as part of baseline configuration
Docker container entrypoint scripts that disable history logging in ephemeral environments

Splunk

spl

(index=linux sourcetype=syslog OR sourcetype=audit
  ("unset HISTFILE" OR "HISTFILE=/dev/null" OR "HISTFILESIZE=0" OR "HISTSIZE=0" OR "HISTCONTROL=ignoreboth" OR "HISTCONTROL=ignorespace" OR "set +o history" OR "history -c" OR "rm -f ~/.bash_history" OR "rm ~/.bash_history" OR "ln -sf /dev/null" OR "MYSQL_HISTFILE"))
OR
(index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (CommandLine="*Set-PSReadlineOption*SaveNothing*" OR CommandLine="*Set-PSReadLineOption*HistorySavePath*" OR CommandLine="*Remove-Item*ConsoleHost_history*" OR CommandLine="*del*ConsoleHost_history*"))
| eval Platform=case(
    sourcetype=="syslog" OR sourcetype=="audit", "Linux/macOS",
    match(sourcetype, "Sysmon"), "Windows",
    true(), "Unknown")
| eval TamperMethod=case(
    match(_raw, "(?i)unset HISTFILE|HISTFILE=/dev/null"), "HISTFILE Disabled",
    match(_raw, "(?i)HISTFILESIZE=0|HISTSIZE=0"), "History Size Zeroed",
    match(_raw, "(?i)HISTCONTROL"), "HISTCONTROL Modified",
    match(_raw, "(?i)history -c"), "History Cleared",
    match(_raw, "(?i)set \+o history"), "History Disabled",
    match(_raw, "(?i)SaveNothing"), "PSReadLine Disabled",
    match(_raw, "(?i)HistorySavePath"), "PSReadLine Redirected",
    true(), "Other")
| table _time, host, User, Platform, TamperMethod, _raw
| sort - _time

Cross-platform detection for command history tampering. Monitors Linux syslog/auditd for HISTFILE and bash_history manipulation, and Windows Sysmon for PSReadLine configuration changes. Categorizes the tampering method for triage prioritization.

medium severity medium confidence

Data Sources

Process: Process Creation Command: Command Execution Sysmon Event ID 1 Linux Syslog Linux Auditd

Required Sourcetypes

syslog audit XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

False Positives

Developers or sysadmins who habitually set HISTCONTROL=ignorespace for convenience when typing sensitive commands
Automated provisioning or hardening scripts that configure shell history settings as part of baseline configuration
Docker container entrypoint scripts that disable history logging in ephemeral environments

IBM QRadar (AQL)

sql

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  username,
  LOGSOURCENAME(logsourceid) AS log_source,
  CATEGORYNAME(category) AS category_name,
  "CommandLine",
  CASE
    WHEN "CommandLine" ILIKE '%unset HISTFILE%' OR "CommandLine" ILIKE '%HISTFILE=/dev/null%' THEN 'HISTFILE Disabled'
    WHEN "CommandLine" ILIKE '%HISTFILESIZE=0%' OR "CommandLine" ILIKE '%HISTSIZE=0%' THEN 'History Size Zeroed'
    WHEN "CommandLine" ILIKE '%HISTCONTROL%' THEN 'HISTCONTROL Modified'
    WHEN "CommandLine" ILIKE '%history -c%' THEN 'History Cleared'
    WHEN "CommandLine" ILIKE '%set +o history%' THEN 'History Disabled'
    WHEN "CommandLine" ILIKE '%SaveNothing%' OR "CommandLine" ILIKE '%HistorySavePath%' THEN 'PSReadLine Tampered'
    WHEN "CommandLine" ILIKE '%ConsoleHost_history%' THEN 'PS History File Deleted'
    WHEN "CommandLine" ILIKE '%bash_history%' AND ("CommandLine" ILIKE '%rm %' OR "CommandLine" ILIKE '%truncate%' OR "CommandLine" ILIKE '%ln -sf%') THEN 'History File Deleted'
    ELSE 'Other'
  END AS tamper_method,
  CASE
    WHEN LOGSOURCETYPEID(logsourceid) = 12 THEN 'Windows'
    WHEN LOGSOURCETYPEID(logsourceid) IN (71, 233, 352) THEN 'Linux/macOS'
    ELSE 'Unknown'
  END AS platform
FROM events
WHERE
  starttime > NOW() - 1 DAYS
  AND (
    "CommandLine" ILIKE '%unset HISTFILE%'
    OR "CommandLine" ILIKE '%HISTFILE=/dev/null%'
    OR "CommandLine" ILIKE '%HISTFILESIZE=0%'
    OR "CommandLine" ILIKE '%HISTSIZE=0%'
    OR "CommandLine" ILIKE '%HISTCONTROL=ignoreboth%'
    OR "CommandLine" ILIKE '%HISTCONTROL=ignorespace%'
    OR "CommandLine" ILIKE '%set +o history%'
    OR "CommandLine" ILIKE '%history -c%'
    OR "CommandLine" ILIKE '%history -w /dev/null%'
    OR "CommandLine" ILIKE '%Set-PSReadlineOption%SaveNothing%'
    OR "CommandLine" ILIKE '%Set-PSReadLineOption%HistorySavePath%'
    OR "CommandLine" ILIKE '%Remove-Item%ConsoleHost_history%'
    OR "CommandLine" ILIKE '%del%ConsoleHost_history%'
    OR ("CommandLine" ILIKE '%bash_history%'
        AND ("CommandLine" ILIKE '%rm -%' OR "CommandLine" ILIKE '%truncate -s 0%' OR "CommandLine" ILIKE '%ln -sf /dev/null%'))
  )
ORDER BY starttime DESC

Detects command history tampering across Linux/macOS and Windows endpoints ingested into QRadar. Queries process execution logs for shell environment variable manipulation, history file deletion, and PSReadLine configuration changes that prevent command logging. Uses CommandLine field populated by Sysmon, auditd, or EDR integrations.

medium severity medium confidence

Data Sources

Sysmon for Windows (via WinCollect or DSM) Linux auditd via QRadar DSM CrowdStrike Falcon via QRadar app Carbon Black via QRadar DSM

Required Tables

events

False Positives

Automated infrastructure-as-code tools (Ansible, Chef, Puppet) that set HISTCONTROL=ignorespace to avoid recording plaintext credentials passed as command arguments during provisioning
Docker container initialization scripts that clear or redirect bash history as part of image build or ephemeral container startup to reduce attack surface
Security teams running STIG compliance enforcement scripts that modify history settings as part of baseline hardening on managed Linux hosts

Sumo Logic CSE

sql

(_sourceCategory=*linux* OR _sourceCategory=*syslog* OR _sourceCategory=*audit* OR _sourceCategory=*windows* OR _sourceCategory=*sysmon*)
| where (
    (%"CommandLine" matches "*unset HISTFILE*"
    OR %"CommandLine" matches "*HISTFILE=/dev/null*"
    OR %"CommandLine" matches "*HISTFILESIZE=0*"
    OR %"CommandLine" matches "*HISTSIZE=0*"
    OR %"CommandLine" matches "*HISTCONTROL=ignoreboth*"
    OR %"CommandLine" matches "*HISTCONTROL=ignorespace*"
    OR %"CommandLine" matches "*set +o history*"
    OR %"CommandLine" matches "*history -c*"
    OR %"CommandLine" matches "*history -w /dev/null*"
    OR %"CommandLine" matches "*Set-PSReadlineOption*SaveNothing*"
    OR %"CommandLine" matches "*Set-PSReadLineOption*HistorySavePath*"
    OR %"CommandLine" matches "*Remove-Item*ConsoleHost_history*"
    OR %"CommandLine" matches "*del*ConsoleHost_history*")
  OR (
    (%"CommandLine" matches "*rm *" OR %"CommandLine" matches "*truncate*" OR %"CommandLine" matches "*ln -sf*")
    AND (%"CommandLine" matches "*bash_history*" OR %"CommandLine" matches "*zsh_history*" OR %"CommandLine" matches "*fish_history*")
  )
)
| if (_sourceCategory matches "*linux*" OR _sourceCategory matches "*syslog*" OR _sourceCategory matches "*audit*", "Linux/macOS",
     if (_sourceCategory matches "*windows*" OR _sourceCategory matches "*sysmon*", "Windows", "Unknown")) as platform
| if (%"CommandLine" matches "*unset HISTFILE*" OR %"CommandLine" matches "*HISTFILE=/dev/null*", "HISTFILE Disabled",
     if (%"CommandLine" matches "*HISTFILESIZE=0*" OR %"CommandLine" matches "*HISTSIZE=0*", "History Size Zeroed",
     if (%"CommandLine" matches "*HISTCONTROL*", "HISTCONTROL Modified",
     if (%"CommandLine" matches "*history -c*", "History Cleared",
     if (%"CommandLine" matches "*set +o history*", "History Disabled",
     if (%"CommandLine" matches "*SaveNothing*" OR %"CommandLine" matches "*HistorySavePath*", "PSReadLine Tampered",
     if (%"CommandLine" matches "*ConsoleHost_history*", "PS History File Deleted",
     if (%"CommandLine" matches "*bash_history*", "History File Manipulated", "Other")))))))) as tamper_method
| fields _messageTime, %host, %user, platform, tamper_method, %"CommandLine"
| sort by _messageTime desc

Detects shell history tampering and PSReadLine configuration abuse across Linux/macOS and Windows hosts. Searches for process command lines containing known history-suppression patterns, including HISTFILE manipulation, history file deletion, redirection to /dev/null, and PowerShell ConsoleHost history file removal or PSReadLine reconfiguration.

medium severity medium confidence

Data Sources

Linux syslog/auditd forwarded to Sumo Logic Windows Sysmon via Sumo Logic collector Sumo Logic CSE normalized process events

Required Tables

Syslog source category Sysmon source category CSE Normalized Events

False Positives

DevOps pipeline agents (Jenkins, GitLab runners, GitHub Actions self-hosted) that disable history recording in their shell wrapper scripts to prevent leaking tokens or credentials into persistent log files
System administrators using set +o history interactively when manually entering passwords or API keys during maintenance windows, then re-enabling with set -o history
Containerized workloads with entrypoint scripts that explicitly unset HISTFILE to reduce artifact footprint in ephemeral environments where persistence is undesirable

Google Chronicle / SecOps

yaral

rule impair_command_history_logging {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects T1562.003 - Impair Command History Logging. Adversaries manipulate shell history environment variables, delete/redirect history files, or modify PSReadLine settings to hide executed commands."
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "T1562.003"
    severity = "MEDIUM"
    priority = "MEDIUM"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.hostname = $hostname
    $e.target.process.command_line = $cmdline
    (
      re.regex($e.target.process.command_line, `(?i)unset\s+HISTFILE`) or
      re.regex($e.target.process.command_line, `(?i)HISTFILE=\/dev\/null`) or
      re.regex($e.target.process.command_line, `(?i)HISTFILESIZE=0`) or
      re.regex($e.target.process.command_line, `(?i)HISTSIZE=0`) or
      re.regex($e.target.process.command_line, `(?i)HISTCONTROL=(ignoreboth|ignorespace)`) or
      re.regex($e.target.process.command_line, `(?i)set\s+\+o\s+history`) or
      re.regex($e.target.process.command_line, `(?i)history\s+-c`) or
      re.regex($e.target.process.command_line, `(?i)history\s+-w\s+\/dev\/null`) or
      re.regex($e.target.process.command_line, `(?i)Set-PSReadline[Oo]ption.*SaveNothing`) or
      re.regex($e.target.process.command_line, `(?i)Set-PSReadLine[Oo]ption.*HistorySavePath`) or
      re.regex($e.target.process.command_line, `(?i)Remove-Item.*ConsoleHost_history`) or
      re.regex($e.target.process.command_line, `(?i)del.*ConsoleHost_history`) or
      (
        re.regex($e.target.process.command_line, `(?i)(rm\s+-[rf]+|truncate\s+-s\s+0|ln\s+-sf\s+/dev/null)`) and
        re.regex($e.target.process.command_line, `(?i)(bash_history|zsh_history|fish_history)`)
      )
    )

  condition:
    $e
}

Chronicle YARA-L 2.0 rule detecting T1562.003 command history tampering. Matches process launch events where the command line contains known patterns for disabling or clearing shell history via environment variable manipulation, history file deletion, /dev/null redirection, or PowerShell PSReadLine configuration abuse. Uses UDM PROCESS_LAUNCH event type and regex matching against target.process.command_line.

medium severity high confidence

Data Sources

Chronicle UDM (Unified Data Model) process events Google Workspace Chronicle ingestion VirusTotal Enterprise Chronicle integration Endpoint EDR logs forwarded to Chronicle

Required Tables

UDM Events (PROCESS_LAUNCH)

False Positives

Legitimate security hardening automation that configures HISTCONTROL=ignorespace as part of CIS benchmark Level 1 Linux baseline implementation across managed server fleets
Cloud-init or user-data scripts on AWS/GCP/Azure instances that unset HISTFILE during first-boot configuration to avoid recording bootstrap credentials in persistent shell history
Red team simulation platforms (Atomic Red Team, VECTR) running T1562.003 atomic tests in authorized purple team exercises

CrowdStrike LogScale (CQL)

cql

#event_simpleName=ProcessRollup2
| CommandLine = /(?i)(unset\s+HISTFILE|HISTFILE=\/dev\/null|HISTFILESIZE=0|HISTSIZE=0|HISTCONTROL=(ignoreboth|ignorespace)|set\s+\+o\s+history|history\s+-c|history\s+-w\s+\/dev\/null|Set-PSReadline[Oo]ption.*SaveNothing|Set-PSReadLine[Oo]ption.*HistorySavePath|Remove-Item.*ConsoleHost_history|del.*ConsoleHost_history)/
  OR (CommandLine = /(?i)(rm\s+-[rf]+|truncate\s+-s\s+0|ln\s+-sf\s+\/dev\/null)/ AND CommandLine = /(?i)(bash_history|zsh_history|fish_history)/)
| case {
    CommandLine = /(?i)unset\s+HISTFILE|HISTFILE=\/dev\/null/ | TamperMethod := "HISTFILE Disabled";
    CommandLine = /(?i)HISTFILESIZE=0|HISTSIZE=0/ | TamperMethod := "History Size Zeroed";
    CommandLine = /(?i)HISTCONTROL/ | TamperMethod := "HISTCONTROL Modified";
    CommandLine = /(?i)history\s+-c/ | TamperMethod := "History Cleared";
    CommandLine = /(?i)set\s+\+o\s+history/ | TamperMethod := "History Disabled";
    CommandLine = /(?i)SaveNothing|HistorySavePath/ | TamperMethod := "PSReadLine Tampered";
    CommandLine = /(?i)ConsoleHost_history/ | TamperMethod := "PS History File Deleted";
    CommandLine = /(?i)(bash_history|zsh_history|fish_history)/ | TamperMethod := "History File Manipulated";
    * | TamperMethod := "Other";
  }
| case {
    CommandLine = /(?i)(PSReadline|ConsoleHost_history)/ | Platform := "Windows";
    CommandLine = /(?i)(HISTFILE|bash_history|history -c|set \+o history)/ | Platform := "Linux/macOS";
    * | Platform := "Unknown";
  }
| table([timestamp, ComputerName, UserName, FileName, CommandLine, TamperMethod, Platform, ParentBaseFileName])
| sort(timestamp, order=desc)

CrowdStrike LogScale CQL query detecting T1562.003 impairment of command history logging. Queries ProcessRollup2 events for shell and PowerShell commands that disable, clear, redirect, or delete command history. Classifies events by tamper method and platform to support triage. Covers HISTFILE/HISTSIZE/HISTCONTROL manipulation on Linux/macOS and PSReadLine abuse on Windows.

medium severity high confidence

Data Sources

CrowdStrike Falcon EDR (ProcessRollup2 events) Falcon Insight XDR process telemetry

Required Tables

ProcessRollup2

False Positives

Falcon sensor deployment scripts and CrowdStrike-managed scripts that clear shell history as part of sensor installation or upgrade procedures on Linux endpoints
Vulnerability scanners and compliance tools (Tenable, Qualys) running authenticated checks that invoke history manipulation as part of their Linux assessment modules
Developer workstations where engineers manually run history -c or set +o history before pasting multi-line secrets or API tokens into terminal sessions during local development

Sigma rule & cross-platform mapping

The detection logic for Impair Command History Logging (T1690) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource:

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1690 Sigma rules on detection.fyi

Platform-specific guides for T1690

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)

Last updated: 2026-04-21 Research depth: deep

References (5)

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1 Disable Bash History via HISTFILE

Expected signal: Auditd execve record for the shell session showing 'unset HISTFILE'. Process creation event in MDE. No bash_history entries will be written for subsequent commands.
Test 2 Redirect History to /dev/null (BPFDoor Pattern)

Expected signal: Auditd execve record. The process /proc/<PID>/environ will show HISTFILE=/dev/null.
Test 3 Disable PSReadLine History on Windows

Expected signal: Sysmon Event ID 1: powershell.exe with CommandLine containing 'Set-PSReadlineOption'. PowerShell ScriptBlock Log Event ID 4104.

Response Playbook

Triage

Determine the platform (Linux/macOS vs Windows) and the specific history impairment method used
Check the user account — is this a known admin or developer who might have legitimate reasons to modify history settings?
Look for the full session context — what other commands were executed before and after the history tampering?
On Linux: check if HISTFILE was redirected to /dev/null (BPFDoor indicator) or if MYSQL_HISTFILE was also set to /dev/null
Check for other defense evasion indicators on the same host — timestamp stomping, log deletion, audit system tampering

Containment

Restore history file from backup if available (HISTFILE may still exist on disk if only the environment variable was unset)
Enable alternative command logging that cannot be easily bypassed (auditd syscall logging on Linux, ScriptBlock Logging on Windows)
If the host is suspected compromised: isolate and begin forensic analysis
Reset user credentials if the account appears compromised
Deploy enhanced monitoring (auditd rules for execve syscalls) to capture commands regardless of shell history settings

Evidence Collection

Linux: /var/log/auth.log or /var/log/secure for session start/end times
Linux: auditd logs with execve syscall rules capture all executed commands regardless of HISTFILE settings
Linux: /proc/<PID>/environ for running processes to check HISTFILE/MYSQL_HISTFILE values
Linux: ~/.bash_history, ~/.zsh_history — check file timestamps, size, and content
Windows: $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
Windows: PowerShell ScriptBlock Logging (Event ID 4104) captures commands even if PSReadLine is disabled

Escalation Criteria

! HISTFILE set to /dev/null combined with MYSQL_HISTFILE=/dev/null — strong indicator of BPFDoor or similar backdoor
! History impairment on a production server or bastion host that should have strict audit logging
! Multiple users on the same host showing history impairment (indicates automated script or widespread compromise)
! History tampering followed by evidence of lateral movement, data exfiltration, or persistence installation

Investigation Guide

Forensic Artifacts

> File System: ~/.bash_history, ~/.zsh_history, ~/.sh_history — check timestamps, size, last modified
> File System: /proc/<PID>/environ — environment variables of running processes may reveal HISTFILE=/dev/null
> File System: $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt — PowerShell history
> Auditd: execve syscall records capture commands even when HISTFILE is disabled
> Auditd: syscall records for unlink/rename on history files
> Windows: Registry HKCU\Console\PSReadLine — PSReadLine configuration

Tuning Guidance

HISTCONTROL=ignorespace is commonly set by default in some Linux distributions and by users who occasionally type sensitive commands (passwords, tokens). Consider only alerting on HISTCONTROL modifications when combined with other indicators. Focus high-severity alerts on HISTFILE=/dev/null and rm ~/.bash_history which are more clearly malicious. On Windows, Set-PSReadlineOption -HistorySaveStyle SaveNothing is rarely legitimate and should be high-confidence.

Hunting Queries

Hunt for accounts frequently disabling command history. Occasional use may be legitimate, but repeated use across multiple devices is suspicious.

Hunting — KQL

kql

DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine has_any ("unset HISTFILE", "HISTFILE=/dev/null", "HISTFILESIZE=0", "history -c", "set +o history")
| summarize Count=count(), Devices=dcount(DeviceName) by AccountName
| where Count > 2
| sort by Count desc

Hunting — SPL

spl

index=linux sourcetype=syslog ("unset HISTFILE" OR "HISTFILE=/dev/null" OR "HISTFILESIZE=0" OR "history -c" OR "set +o history")
| stats count, dc(host) as Devices by User
| where count > 2
| sort - count

Atomic Red Team Tests

Test 1 Disable Bash History via HISTFILE

linux

Unsets the HISTFILE environment variable, preventing the current shell session from saving command history to disk. This technique was used by APT38 (BeagleBoyz) and Sea Turtle.

Command

bash

unset HISTFILE && export HISTFILESIZE=0

Cleanup

bash

export HISTFILE=~/.bash_history && export HISTFILESIZE=10000

Expected Telemetry

Auditd execve record for the shell session showing 'unset HISTFILE'. Process creation event in MDE. No bash_history entries will be written for subsequent commands.

Expected Detection

KQL: TamperMethod='HISTFILE Disabled'. SPL: TamperMethod='HISTFILE Disabled'.

Test 2 Redirect History to /dev/null (BPFDoor Pattern)

linux

Redirects both HISTFILE and MYSQL_HISTFILE to /dev/null, matching the exact pattern used by BPFDoor malware to hide shell and database query history.

Command

bash

export HISTFILE=/dev/null && export MYSQL_HISTFILE=/dev/null

Cleanup

bash

export HISTFILE=~/.bash_history && unset MYSQL_HISTFILE

Expected Telemetry

Auditd execve record. The process /proc/<PID>/environ will show HISTFILE=/dev/null.

Expected Detection

KQL: TamperMethod='HISTFILE Disabled'. SPL: TamperMethod='HISTFILE Disabled'.

Test 3 Disable PSReadLine History on Windows

windows

Configures PowerShell PSReadLine to stop saving command history. This prevents commands from being written to ConsoleHost_history.txt.

Command

powershell

powershell.exe -Command "Set-PSReadlineOption -HistorySaveStyle SaveNothing"

Cleanup

powershell

powershell.exe -Command "Set-PSReadlineOption -HistorySaveStyle SaveIncrementally"

Expected Telemetry

Sysmon Event ID 1: powershell.exe with CommandLine containing 'Set-PSReadlineOption'. PowerShell ScriptBlock Log Event ID 4104.

Expected Detection

KQL: TamperMethod='PSReadLine Disabled'. SPL: TamperMethod='PSReadLine Disabled'.

Related Detections

Tactic Hub

TA0112 Defense Impairment ATT&CK Matrix

Related Techniques

T1562 Impair Defenses T1070.003 Clear Command History T1059.004 Unix Shell T1059.001 PowerShell

What is T1690 Impair Command History Logging?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for T1690

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hub

Related Techniques

Same Tactic: Defense Impairment

Popular Detections

Get new detections in your inbox