Skip to content
T1690 Sumo Logic CSE · Sumo

Detect Impair Command History Logging in Sumo Logic CSE

Adversaries may impair command history logging to hide commands they run on a compromised system. On Linux and macOS, this involves manipulating HISTFILE, HISTFILESIZE, HISTSIZE, and HISTCONTROL environment variables, or redirecting history to /dev/null. On Windows, adversaries may modify PSReadLine settings to disable PowerShell command history. On network devices, adversaries may disable command logging entirely.

MITRE ATT&CK

Tactic
Defense Impairment
Technique
T1690 Prevent Command History Logging
Canonical reference
https://attack.mitre.org/techniques/T1690/

Sumo Detection Query

Sumo Logic CSE (Sumo)
sql 
(_sourceCategory=*linux* OR _sourceCategory=*syslog* OR _sourceCategory=*audit* OR _sourceCategory=*windows* OR _sourceCategory=*sysmon*)
| where (
    (%"CommandLine" matches "*unset HISTFILE*"
    OR %"CommandLine" matches "*HISTFILE=/dev/null*"
    OR %"CommandLine" matches "*HISTFILESIZE=0*"
    OR %"CommandLine" matches "*HISTSIZE=0*"
    OR %"CommandLine" matches "*HISTCONTROL=ignoreboth*"
    OR %"CommandLine" matches "*HISTCONTROL=ignorespace*"
    OR %"CommandLine" matches "*set +o history*"
    OR %"CommandLine" matches "*history -c*"
    OR %"CommandLine" matches "*history -w /dev/null*"
    OR %"CommandLine" matches "*Set-PSReadlineOption*SaveNothing*"
    OR %"CommandLine" matches "*Set-PSReadLineOption*HistorySavePath*"
    OR %"CommandLine" matches "*Remove-Item*ConsoleHost_history*"
    OR %"CommandLine" matches "*del*ConsoleHost_history*")
  OR (
    (%"CommandLine" matches "*rm *" OR %"CommandLine" matches "*truncate*" OR %"CommandLine" matches "*ln -sf*")
    AND (%"CommandLine" matches "*bash_history*" OR %"CommandLine" matches "*zsh_history*" OR %"CommandLine" matches "*fish_history*")
  )
)
| if (_sourceCategory matches "*linux*" OR _sourceCategory matches "*syslog*" OR _sourceCategory matches "*audit*", "Linux/macOS",
     if (_sourceCategory matches "*windows*" OR _sourceCategory matches "*sysmon*", "Windows", "Unknown")) as platform
| if (%"CommandLine" matches "*unset HISTFILE*" OR %"CommandLine" matches "*HISTFILE=/dev/null*", "HISTFILE Disabled",
     if (%"CommandLine" matches "*HISTFILESIZE=0*" OR %"CommandLine" matches "*HISTSIZE=0*", "History Size Zeroed",
     if (%"CommandLine" matches "*HISTCONTROL*", "HISTCONTROL Modified",
     if (%"CommandLine" matches "*history -c*", "History Cleared",
     if (%"CommandLine" matches "*set +o history*", "History Disabled",
     if (%"CommandLine" matches "*SaveNothing*" OR %"CommandLine" matches "*HistorySavePath*", "PSReadLine Tampered",
     if (%"CommandLine" matches "*ConsoleHost_history*", "PS History File Deleted",
     if (%"CommandLine" matches "*bash_history*", "History File Manipulated", "Other")))))))) as tamper_method
| fields _messageTime, %host, %user, platform, tamper_method, %"CommandLine"
| sort by _messageTime desc
medium severity medium confidence

Detects shell history tampering and PSReadLine configuration abuse across Linux/macOS and Windows hosts. Searches for process command lines containing known history-suppression patterns, including HISTFILE manipulation, history file deletion, redirection to /dev/null, and PowerShell ConsoleHost history file removal or PSReadLine reconfiguration.

Data Sources

Linux syslog/auditd forwarded to Sumo LogicWindows Sysmon via Sumo Logic collectorSumo Logic CSE normalized process events

Required Tables

Syslog source categorySysmon source categoryCSE Normalized Events

False Positives & Tuning

  • DevOps pipeline agents (Jenkins, GitLab runners, GitHub Actions self-hosted) that disable history recording in their shell wrapper scripts to prevent leaking tokens or credentials into persistent log files
  • System administrators using set +o history interactively when manually entering passwords or API keys during maintenance windows, then re-enabling with set -o history
  • Containerized workloads with entrypoint scripts that explicitly unset HISTFILE to reduce artifact footprint in ephemeral environments where persistence is undesirable

Other platforms for T1690

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1 Disable Bash History via HISTFILE

    Expected signal: Auditd execve record for the shell session showing 'unset HISTFILE'. Process creation event in MDE. No bash_history entries will be written for subsequent commands.

  2. Test 2 Redirect History to /dev/null (BPFDoor Pattern)

    Expected signal: Auditd execve record. The process /proc/<PID>/environ will show HISTFILE=/dev/null.

  3. Test 3 Disable PSReadLine History on Windows

    Expected signal: Sysmon Event ID 1: powershell.exe with CommandLine containing 'Set-PSReadlineOption'. PowerShell ScriptBlock Log Event ID 4104.

Last updated: 2026-04-21 Research depth: deep
References (5)

Response Playbook

Triage

  1. Determine the platform (Linux/macOS vs Windows) and the specific history impairment method used
  2. Check the user account — is this a known admin or developer who might have legitimate reasons to modify history settings?
  3. Look for the full session context — what other commands were executed before and after the history tampering?
  4. On Linux: check if HISTFILE was redirected to /dev/null (BPFDoor indicator) or if MYSQL_HISTFILE was also set to /dev/null
  5. Check for other defense evasion indicators on the same host — timestamp stomping, log deletion, audit system tampering

Containment

  1. Restore history file from backup if available (HISTFILE may still exist on disk if only the environment variable was unset)
  2. Enable alternative command logging that cannot be easily bypassed (auditd syscall logging on Linux, ScriptBlock Logging on Windows)
  3. If the host is suspected compromised: isolate and begin forensic analysis
  4. Reset user credentials if the account appears compromised
  5. Deploy enhanced monitoring (auditd rules for execve syscalls) to capture commands regardless of shell history settings

Evidence Collection

  1. Linux: /var/log/auth.log or /var/log/secure for session start/end times
  2. Linux: auditd logs with execve syscall rules capture all executed commands regardless of HISTFILE settings
  3. Linux: /proc/<PID>/environ for running processes to check HISTFILE/MYSQL_HISTFILE values
  4. Linux: ~/.bash_history, ~/.zsh_history — check file timestamps, size, and content
  5. Windows: $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
  6. Windows: PowerShell ScriptBlock Logging (Event ID 4104) captures commands even if PSReadLine is disabled

Escalation Criteria

  • !HISTFILE set to /dev/null combined with MYSQL_HISTFILE=/dev/null — strong indicator of BPFDoor or similar backdoor
  • !History impairment on a production server or bastion host that should have strict audit logging
  • !Multiple users on the same host showing history impairment (indicates automated script or widespread compromise)
  • !History tampering followed by evidence of lateral movement, data exfiltration, or persistence installation

Investigation Guide

Forensic Artifacts

  • >File System: ~/.bash_history, ~/.zsh_history, ~/.sh_history — check timestamps, size, last modified
  • >File System: /proc/<PID>/environ — environment variables of running processes may reveal HISTFILE=/dev/null
  • >File System: $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt — PowerShell history
  • >Auditd: execve syscall records capture commands even when HISTFILE is disabled
  • >Auditd: syscall records for unlink/rename on history files
  • >Windows: Registry HKCU\Console\PSReadLine — PSReadLine configuration

Tuning Guidance

HISTCONTROL=ignorespace is commonly set by default in some Linux distributions and by users who occasionally type sensitive commands (passwords, tokens). Consider only alerting on HISTCONTROL modifications when combined with other indicators. Focus high-severity alerts on HISTFILE=/dev/null and rm ~/.bash_history which are more clearly malicious. On Windows, Set-PSReadlineOption -HistorySaveStyle SaveNothing is rarely legitimate and should be high-confidence.

Hunting Queries

Hunt for accounts frequently disabling command history. Occasional use may be legitimate, but repeated use across multiple devices is suspicious.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine has_any ("unset HISTFILE", "HISTFILE=/dev/null", "HISTFILESIZE=0", "history -c", "set +o history")
| summarize Count=count(), Devices=dcount(DeviceName) by AccountName
| where Count > 2
| sort by Count desc
Hunting — SPL
spl 
index=linux sourcetype=syslog ("unset HISTFILE" OR "HISTFILE=/dev/null" OR "HISTFILESIZE=0" OR "history -c" OR "set +o history")
| stats count, dc(host) as Devices by User
| where count > 2
| sort - count

Atomic Red Team Tests

Test 1 Disable Bash History via HISTFILE
linux

Unsets the HISTFILE environment variable, preventing the current shell session from saving command history to disk. This technique was used by APT38 (BeagleBoyz) and Sea Turtle.

Command

bash 
unset HISTFILE && export HISTFILESIZE=0

Cleanup

bash 
export HISTFILE=~/.bash_history && export HISTFILESIZE=10000

Expected Telemetry

Auditd execve record for the shell session showing 'unset HISTFILE'. Process creation event in MDE. No bash_history entries will be written for subsequent commands.

Expected Detection

KQL: TamperMethod='HISTFILE Disabled'. SPL: TamperMethod='HISTFILE Disabled'.

Test 2 Redirect History to /dev/null (BPFDoor Pattern)
linux

Redirects both HISTFILE and MYSQL_HISTFILE to /dev/null, matching the exact pattern used by BPFDoor malware to hide shell and database query history.

Command

bash 
export HISTFILE=/dev/null && export MYSQL_HISTFILE=/dev/null

Cleanup

bash 
export HISTFILE=~/.bash_history && unset MYSQL_HISTFILE

Expected Telemetry

Auditd execve record. The process /proc/<PID>/environ will show HISTFILE=/dev/null.

Expected Detection

KQL: TamperMethod='HISTFILE Disabled'. SPL: TamperMethod='HISTFILE Disabled'.

Test 3 Disable PSReadLine History on Windows
windows

Configures PowerShell PSReadLine to stop saving command history. This prevents commands from being written to ConsoleHost_history.txt.

Command

powershell 
powershell.exe -Command "Set-PSReadlineOption -HistorySaveStyle SaveNothing"

Cleanup

powershell 
powershell.exe -Command "Set-PSReadlineOption -HistorySaveStyle SaveIncrementally"

Expected Telemetry

Sysmon Event ID 1: powershell.exe with CommandLine containing 'Set-PSReadlineOption'. PowerShell ScriptBlock Log Event ID 4104.

Expected Detection

KQL: TamperMethod='PSReadLine Disabled'. SPL: TamperMethod='PSReadLine Disabled'.

Related Detections

Tactic Hub

TA0112 Defense Impairment ATT&CK Matrix

Related Techniques

T1562 Impair Defenses T1070.003 Clear Command History T1059.004 Unix Shell T1059.001 PowerShell

Same Tactic: Defense Impairment

Popular Detections