Query: rule covering Detects commands that try to clear or tamper with the Linux command history. This technique is used by threat actors in
Matching passage: Sigma rule: Detects commands that try to clear or tamper with the Linux command history. This technique is used by threat actors in. Logsource: linux. Rule: title: Linux Command History Tampering id: fdc88d25-96fb-4b7c-9633-c0e417fdbd4e status: test description: 'Detects commands that try to clear or tamper with the Linux command history. This technique is used by threat actors in order to evade defenses and execute commands without them being recorded in files such as "bash_history" or "zsh_history". ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.003/T1070.003.md - https://www.hackers-arise.com/post/2016/06/20/covering-your-bash-shell-tracks-antiforensics - https://www.cadosecurity.com/spinning-yarn-a-new-linux-malware-campaign-targets-docker-apache-hadoop-redis-and-confluence/ author: Patrick Bareiss date: 2019-03-24 modified: 2024-04-17 tags: - attack.stealth - attack.t1070.003 logsource: product: linux detection: keywords: - cat /dev/null >*sh_history - cat /dev/zero >*sh_history - chattr +i*sh_history - echo "" >*sh_history - empty_bash_history - export HISTFILESIZE=0 - history -c - history -w - ln -sf /dev/null *sh_history - ln -sf /dev/zero *sh_history - rm *sh_history - shopt -ou history - shopt -uo history - shred *sh_history - truncate -s0 *sh_history condition: keywords falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects attempts to query system information directly from the Windows Registry.. Logsource: windows / process_creation. Rule: title: System Information Discovery via Registry Queries id: 0022869c-49f7-4ff2-ba03-85ac42ddac58 status: experimental description: Detects attempts to query system information directly from the Windows Registry. references: - https://cert.gov.ua/article/6277849 - https://github.com/redcanaryco/atomic-red-team/blob/75fa21076dcefa348a7521403cdd6bfc4e88623c/atomics/T1082/T1082.md - https://github.com/redcanaryco/atomic-red-team/blob/75fa21076dcefa348a7521403cdd6bfc4e88623c/atomics/T1124/T1124.md author: lazarg date: 2025-06-12 modified: 2025-10-25 tags: - attack.discovery - attack.t1082 logsource: category: process_creation product: windows detection: selection_cmd_reg: Image|endswith: \reg.exe CommandLine|contains: query CommandLine|contains|windash: -v selection_cmd_powershell: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains: - Get-ItemPropertyValue - gpv selection_keys: CommandLine|contains: - \SOFTWARE\Microsoft\Windows Defender - \SOFTWARE\Microsoft\Windows NT\CurrentVersion - \SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall - \SYSTEM\CurrentControlSet\Control\TimeZoneInformation - \SYSTEM\CurrentControlSet\Services condition: 1 of selection_cmd_* and selection_keys falsepositives: - Unlikely level: low regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_discovery_via_reg_queries/info.yml simulation: - type: atomic-red-team name: System Information Discovery technique: T1010 atomic_guid: 66703791-c902-4560-8770-42b8a91f7667 - type: atomic-red-team name: Discover OS Product Name via Registry technique: T1082 atomic_guid: be3b5fe3-a575-4fb8-83f6-ad4a68dd5ce7 - type: atomic-red-team name: Discover OS Build Number via Registry technique: T1082 atomic_guid: acfcd709-0013-4f1e-b9ee-bc1e7bafaaec