# T1690 - Prevent Command History Logging

## Description from ATT&CK

> Adversaries may impair command history logging to hide commands they run on a compromised system. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they have done.
> 
> On Linux and macOS, command history is tracked in a file pointed to by the environment variable `HISTFILE`. When a user logs off a system, this information is flushed to a file in the user's home directory called `~/.bash_history`. The `HISTCONTROL` environment variable keeps track of what should be saved by the history command and eventually into the `~/.bash_history` file when a user logs out. `HISTCONTROL` does not exist by default on macOS, but can be set by the user and will be respected. The `HISTFILE` environment variable is also used in some ESXi systems.(Citation: Google Cloud Threat Intelligence ESXi VIBs 2022)
> 
> Adversaries may clear the history environment variable (`unset HISTFILE`) or set the command history size to zero (`export HISTFILESIZE=0`) to prevent logging of commands. Additionally, `HISTCONTROL` can be configured to ignore commands that start with a space by simply setting it to "ignorespace". `HISTCONTROL` can also be set to ignore duplicate commands by setting it to "ignoredups". In some Linux systems, this is set by default to "ignoreboth" which covers both of the previous examples. This means that " ls" will not be saved, but "ls" would be saved by history. Adversaries can abuse this to operate without leaving traces by simply prepending a space to all of their terminal commands.
> 
> On Windows systems, the `PSReadLine` module tracks commands used in all PowerShell sessions and writes them to a file (`$env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt` by default). Adversaries may change where these logs are saved using `Set-PSReadLineOption -HistorySavePath {File Path}`. This will cause `ConsoleHost_history.txt` to stop receiving logs. Additionally, it is possible to turn off logging to this file using the PowerShell command `Set-PSReadlineOption -HistorySaveStyle SaveNothing`.(Citation: Microsoft about_History prevent command history)(Citation: Sophos PowerShell Command History Forensics)
> 
> Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to disable historical command logging (e.g. `no logging`).

[Source](https://attack.mitre.org/techniques/T1690)

## Atomic Tests

- [Atomic Test #1: Disable history collection](#atomic-test-1-disable-history-collection)
- [Atomic Test #2: Disable history collection (freebsd)](#atomic-test-2-disable-history-collection-freebsd)
- [Atomic Test #3: Mac HISTCONTROL](#atomic-test-3-mac-histcontrol)
- [Atomic Test #4: Clear bash history](#atomic-test-4-clear-bash-history)
- [Atomic Test #5: Setting the HISTCONTROL environment variable](#atomic-test-5-setting-the-histcontrol-environment-variable)
- [Atomic Test #6: Setting the HISTFILESIZE environment variable](#atomic-test-6-setting-the-histfilesize-environment-variable)
- [Atomic Test #7: Setting the HISTSIZE environment variable](#atomic-test-7-setting-the-histsize-environment-variable)
- [Atomic Test #8: Setting the HISTFILE environment variable](#atomic-test-8-setting-the-histfile-environment-variable)
- [Atomic Test #9: Setting the HISTFILE environment variable (freebsd)](#atomic-test-9-setting-the-histfile-environment-variable-freebsd)
- [Atomic Test #10: Setting the HISTIGNORE environment variable](#atomic-test-10-setting-the-histignore-environment-variable)
- [Atomic Test #11: Disable Windows Command Line Auditing using reg.exe](#atomic-test-11-disable-windows-command-line-auditing-using-regexe)
- [Atomic Test #12: Disable Windows Command Line Auditing using Powershell Cmdlet](#atomic-test-12-disable-windows-command-line-auditing-using-powershell-cmdlet)

### Atomic Test #1: Disable history collection

Disables history collection in shells

**Supported Platforms:** Linux, macOS

**auto_generated_guid:** `4eafdb45-0f79-4d66-aa86-a3e2c08791f5`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| evil_command | Command to run after shell history collection is disabled | string | whoami|

#### Attack Commands: Run with `sh`!

```sh
export HISTCONTROL=ignoreboth
#{evil_command}
```

### Atomic Test #2: Disable history collection (freebsd)

Disables history collection in shells

**Supported Platforms:** Linux

**auto_generated_guid:** `cada55b4-8251-4c60-819e-8ec1b33c9306`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| evil_command | Command to run after shell history collection is disabled | string | whoami|

#### Attack Commands: Run with `sh`!

```sh
export HISTSIZE=0
#{evil_command}
```

### Atomic Test #3: Mac HISTCONTROL

The HISTCONTROL variable is set to ignore (not write to the history file) command that are a duplicate of something already in the history 
and commands that start with a space. This atomic sets this variable in the current session and also writes it to the current user's ~/.bash_profile 
so that it will apply to all future settings as well.
https://www.linuxjournal.com/content/using-bash-history-more-efficiently-histcontrol

**Supported Platforms:** macOS, Linux

**auto_generated_guid:** `468566d5-83e5-40c1-b338-511e1659628d`

#### Attack Commands: Run it with these steps! 
1. export HISTCONTROL=ignoreboth
2. echo export "HISTCONTROL=ignoreboth" >> ~/.bash_profile
3. ls
4. whoami > recon.txt


### Atomic Test #4: Clear bash history

An attacker may clear the bash history cache and the history file as their last act before logging off to remove the record of their command line activities. 

In this test we use the $HISTFILE variable throughout to 1. confirms the $HISTFILE variable is set 2. echo "" into it 3..5 confirm the file is empty 6 clear the history cache 7. confirm the history cache is empty. This is when the attacker would logoff.

**Supported Platforms:** Linux

**auto_generated_guid:** `878794f7-c511-4199-a950-8c28b3ed8e5b`

#### Attack Commands: Run with `bash`!

```bash
cp $HISTFILE $HISTFILE.OLD
if ((${#HISTFILE[@]})); then echo $HISTFILE; fi
echo "" > $HISTFILE
if [ $(wc -c <$HISTFILE) -gt 1 ]; then echo "$HISTFILE is larger than 1k"; fi
ls -la $HISTFILE 
cat $HISTFILE
history -c 
if [ $(history |wc -l) -eq 1 ]; then echo "History cache cleared"; fi
```

#### Cleanup Commands

```bash
mv -f $HISTFILE.OLD $HISTFILE
```
### Atomic Test #5: Setting the HISTCONTROL environment variable

An attacker may exploit the space before a command (e.g. " ls") or the duplicate command suppression feature in Bash history to prevent their commands from being recorded in the history file or to obscure the order of commands used. 

In this test we 1. sets $HISTCONTROL to ignoreboth 2. clears the history cache 3. executes l