Detect Impair Command History Logging in Microsoft Sentinel
Adversaries may impair command history logging to hide commands they run on a compromised system. On Linux and macOS, this involves manipulating HISTFILE, HISTFILESIZE, HISTSIZE, and HISTCONTROL environment variables, or redirecting history to /dev/null. On Windows, adversaries may modify PSReadLine settings to disable PowerShell command history. On network devices, adversaries may disable command logging entirely.
MITRE ATT&CK
- Tactic
- Defense Impairment
- Technique
- T1690 Prevent Command History Logging
- Canonical reference
- https://attack.mitre.org/techniques/T1690/
KQL Detection Query
let HistoryTampering = dynamic(["unset HISTFILE", "export HISTFILE=/dev/null", "export HISTFILESIZE=0", "export HISTSIZE=0", "HISTCONTROL=ignoreboth", "HISTCONTROL=ignorespace", "set +o history", "history -c", "history -w /dev/null", "rm -f ~/.bash_history", "truncate -s 0", "ln -sf /dev/null", "Set-PSReadlineOption -HistorySaveStyle SaveNothing", "Set-PSReadLineOption -HistorySavePath", "Remove-Item*ConsoleHost_history.txt", "del*ConsoleHost_history.txt"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any (HistoryTampering)
| extend Platform = case(
ProcessCommandLine has_any ("PSReadline", "ConsoleHost_history"), "Windows",
ProcessCommandLine has_any ("HISTFILE", "bash_history", "history -c", "set +o history"), "Linux/macOS",
"Unknown")
| extend TamperMethod = case(
ProcessCommandLine has "unset HISTFILE" or ProcessCommandLine has "HISTFILE=/dev/null", "HISTFILE Disabled",
ProcessCommandLine has "HISTFILESIZE=0" or ProcessCommandLine has "HISTSIZE=0", "History Size Zeroed",
ProcessCommandLine has "HISTCONTROL", "HISTCONTROL Modified",
ProcessCommandLine has "history -c", "History Cleared",
ProcessCommandLine has "set +o history", "History Disabled",
ProcessCommandLine has "rm" or ProcessCommandLine has "truncate" or ProcessCommandLine has "ln -sf /dev/null", "History File Deleted/Redirected",
ProcessCommandLine has "SaveNothing", "PSReadLine Disabled",
ProcessCommandLine has "HistorySavePath", "PSReadLine Redirected",
ProcessCommandLine has "ConsoleHost_history", "PS History File Deleted",
"Other")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, Platform, TamperMethod, InitiatingProcessFileName
| sort by Timestamp descDetects command history tampering on both Linux/macOS (HISTFILE, HISTCONTROL, bash_history manipulation) and Windows (PSReadLine settings, ConsoleHost_history.txt deletion). Uses MDE DeviceProcessEvents to monitor process command lines for history impairment patterns.
Data Sources
Required Tables
False Positives & Tuning
- Developers or sysadmins who habitually set HISTCONTROL=ignorespace for convenience when typing sensitive commands (e.g., inline passwords)
- Automated provisioning or hardening scripts that configure shell history settings as part of baseline configuration
- Docker container entrypoint scripts that disable history logging in ephemeral environments
Other platforms for T1690
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 Disable Bash History via HISTFILE
Expected signal: Auditd execve record for the shell session showing 'unset HISTFILE'. Process creation event in MDE. No bash_history entries will be written for subsequent commands.
- Test 2 Redirect History to /dev/null (BPFDoor Pattern)
Expected signal: Auditd execve record. The process /proc/<PID>/environ will show HISTFILE=/dev/null.
- Test 3 Disable PSReadLine History on Windows
Expected signal: Sysmon Event ID 1: powershell.exe with CommandLine containing 'Set-PSReadlineOption'. PowerShell ScriptBlock Log Event ID 4104.
References (5)
- https://attack.mitre.org/techniques/T1690/
- https://sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/
- https://www.cisa.gov/sites/default/files/publications/AA20-239A_Joint_Advisory.pdf
- https://learn.microsoft.com/en-us/powershell/module/psreadline/set-psreadlineoption
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.003/T1562.003.md
Response Playbook
Triage
- Determine the platform (Linux/macOS vs Windows) and the specific history impairment method used
- Check the user account — is this a known admin or developer who might have legitimate reasons to modify history settings?
- Look for the full session context — what other commands were executed before and after the history tampering?
- On Linux: check if HISTFILE was redirected to /dev/null (BPFDoor indicator) or if MYSQL_HISTFILE was also set to /dev/null
- Check for other defense evasion indicators on the same host — timestamp stomping, log deletion, audit system tampering
Containment
- Restore history file from backup if available (HISTFILE may still exist on disk if only the environment variable was unset)
- Enable alternative command logging that cannot be easily bypassed (auditd syscall logging on Linux, ScriptBlock Logging on Windows)
- If the host is suspected compromised: isolate and begin forensic analysis
- Reset user credentials if the account appears compromised
- Deploy enhanced monitoring (auditd rules for execve syscalls) to capture commands regardless of shell history settings
Evidence Collection
- Linux: /var/log/auth.log or /var/log/secure for session start/end times
- Linux: auditd logs with execve syscall rules capture all executed commands regardless of HISTFILE settings
- Linux: /proc/<PID>/environ for running processes to check HISTFILE/MYSQL_HISTFILE values
- Linux: ~/.bash_history, ~/.zsh_history — check file timestamps, size, and content
- Windows: $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
- Windows: PowerShell ScriptBlock Logging (Event ID 4104) captures commands even if PSReadLine is disabled
Escalation Criteria
- !HISTFILE set to /dev/null combined with MYSQL_HISTFILE=/dev/null — strong indicator of BPFDoor or similar backdoor
- !History impairment on a production server or bastion host that should have strict audit logging
- !Multiple users on the same host showing history impairment (indicates automated script or widespread compromise)
- !History tampering followed by evidence of lateral movement, data exfiltration, or persistence installation
Investigation Guide
Forensic Artifacts
- >
File System: ~/.bash_history, ~/.zsh_history, ~/.sh_history — check timestamps, size, last modified - >
File System: /proc/<PID>/environ — environment variables of running processes may reveal HISTFILE=/dev/null - >
File System: $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt — PowerShell history - >
Auditd: execve syscall records capture commands even when HISTFILE is disabled - >
Auditd: syscall records for unlink/rename on history files - >
Windows: Registry HKCU\Console\PSReadLine — PSReadLine configuration
Tuning Guidance
HISTCONTROL=ignorespace is commonly set by default in some Linux distributions and by users who occasionally type sensitive commands (passwords, tokens). Consider only alerting on HISTCONTROL modifications when combined with other indicators. Focus high-severity alerts on HISTFILE=/dev/null and rm ~/.bash_history which are more clearly malicious. On Windows, Set-PSReadlineOption -HistorySaveStyle SaveNothing is rarely legitimate and should be high-confidence.
Hunting Queries
Hunt for accounts frequently disabling command history. Occasional use may be legitimate, but repeated use across multiple devices is suspicious.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine has_any ("unset HISTFILE", "HISTFILE=/dev/null", "HISTFILESIZE=0", "history -c", "set +o history")
| summarize Count=count(), Devices=dcount(DeviceName) by AccountName
| where Count > 2
| sort by Count descindex=linux sourcetype=syslog ("unset HISTFILE" OR "HISTFILE=/dev/null" OR "HISTFILESIZE=0" OR "history -c" OR "set +o history")
| stats count, dc(host) as Devices by User
| where count > 2
| sort - countAtomic Red Team Tests
Unsets the HISTFILE environment variable, preventing the current shell session from saving command history to disk. This technique was used by APT38 (BeagleBoyz) and Sea Turtle.
Command
unset HISTFILE && export HISTFILESIZE=0Cleanup
export HISTFILE=~/.bash_history && export HISTFILESIZE=10000Expected Telemetry
Auditd execve record for the shell session showing 'unset HISTFILE'. Process creation event in MDE. No bash_history entries will be written for subsequent commands.
Expected Detection
KQL: TamperMethod='HISTFILE Disabled'. SPL: TamperMethod='HISTFILE Disabled'.
Redirects both HISTFILE and MYSQL_HISTFILE to /dev/null, matching the exact pattern used by BPFDoor malware to hide shell and database query history.
Command
export HISTFILE=/dev/null && export MYSQL_HISTFILE=/dev/nullCleanup
export HISTFILE=~/.bash_history && unset MYSQL_HISTFILEExpected Telemetry
Auditd execve record. The process /proc/<PID>/environ will show HISTFILE=/dev/null.
Expected Detection
KQL: TamperMethod='HISTFILE Disabled'. SPL: TamperMethod='HISTFILE Disabled'.
Configures PowerShell PSReadLine to stop saving command history. This prevents commands from being written to ConsoleHost_history.txt.
Command
powershell.exe -Command "Set-PSReadlineOption -HistorySaveStyle SaveNothing"Cleanup
powershell.exe -Command "Set-PSReadlineOption -HistorySaveStyle SaveIncrementally"Expected Telemetry
Sysmon Event ID 1: powershell.exe with CommandLine containing 'Set-PSReadlineOption'. PowerShell ScriptBlock Log Event ID 4104.
Expected Detection
KQL: TamperMethod='PSReadLine Disabled'. SPL: TamperMethod='PSReadLine Disabled'.