T1070.003 — Clear Command History

Tactic: Stealth · Platforms: ESXi, Linux, macOS, Network Devices, Windows

In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done. On Linux…

Sub-technique of Indicator Removal (T1070).

Sigma detection rules (5)

title: "T1070.003 Indicator Removal: Clear Command History"
id: d687a315-1a7a-4008-9ef9-eda6db24f84d
description: 'Behavioral Detection of Command History Clearing via deletion of the PowerShell PSReadLine console history file (ConsoleHost_history.txt). (Data Component: File Deletion; baseline tier: windows-eventid.) Tune using: HistoryFilePath, UserContext, CommandPattern.'
references:
  - https://attack.mitre.org/techniques/T1070/003
author: Shahrukh Khan
date: 2026-06-12
license: MIT
tags:
  - attack.stealth
  - attack.t1070.003

logsource:
  category: file_delete
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '23'
    TargetFilename|contains: '\PSReadLine\'
    TargetFilename|endswith: '\ConsoleHost_history.txt'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.

level: medium

title: "T1070.003 Indicator Removal: Clear Command History"
id: aeb31107-e37f-43b3-9752-2ee989ea7c72
description: 'Behavioral Detection of Command History Clearing. Fixed: history and unset are shell builtins that never generate their own EXECVE record (even wrapped via bash -c, the outer EXECVE shows bash/sh as a0, not history/unset), so those two standalone selections could never fire on real telemetry and have been replaced with (1) a PATH-based selection for deletion of ~/.bash_history and (2) an EXECVE selection that catches the builtins when passed as a literal one-liner string to an interpreters -c argument, alongside the original ln -sf /dev/null selection. Tune using: TimeWindow, UserContext, HistoryFilePath.'
references:
  - https://attack.mitre.org/techniques/T1070/003
author: Shahrukh Khan
date: 2026-01-16
modified: 2026-07-26
license: MIT
tags:
  - attack.stealth
  - attack.t1070.003

logsource:
  category: process_creation
  product: linux

detection:
  selection_devnull:
    type: EXECVE
    a0|endswith: '/ln'
    a1: '-sf'
    a2: '/dev/null'
  selection_builtin_wrapped:
    type: EXECVE
    a0|endswith:
      - '/bash'
      - '/sh'
    a1: '-c'
    a2|contains:
      - 'history -c'
      - 'unset HISTFILE'
      - 'HISTFILE='
  selection_rm_histfile:
    type: PATH
    nametype: DELETE
    name|endswith: '/.bash_history'

  condition: 1 of selection_*

falsepositives:
  - Some hardening scripts and shared/kiosk shell profiles intentionally disable history or unset HISTFILE via a wrapped one-liner, and legitimate account-cleanup tooling may delete a stale .bash_history; correlate with an active interactive session and preceding suspicious commands rather than alerting standalone.

level: medium

title: "T1070.003 Indicator Removal: Clear Command History"
id: cb4ba050-8a0d-47d2-bb8d-6d921f041249
description: 'Behavioral Detection of Command History Clearing. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TimeWindow, UserContext, HistoryFilePath.'
references:
  - https://attack.mitre.org/techniques/T1070/003
author: Shahrukh Khan
date: 2026-05-06
license: MIT
tags:
  - attack.stealth
  - attack.t1070.003

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    CommandLine|contains:
      - 'history -c'
      - 'unset HISTFILE'
      - 'HISTFILE=/dev/null'
      - '.bash_history'
      - '.zsh_history'

  condition: selection

falsepositives:
  - Administrators occasionally clear shell history intentionally during shared workstation maintenance.

level: medium

title: "T1070.003 Indicator Removal: Clear Command History"
id: c6f00031-0526-4815-96af-afeffee9dee6
description: 'Behavioral Detection of Command History Clearing. history -c, unset HISTFILE, and export HISTSIZE=0 are shell builtins that never generate their own EXECVE record, so those three selectors could never fire on real telemetry; only the rm/shred branches were actually reachable. Replaced the unreachable builtin selectors with a single selection that catches these commands when passed as a literal string to an interpreter''s -c argument (e.g. bash -c "history -c"), which is the invocation shape auditd can observe, alongside the existing rm/shred selectors. (Data Component: Command Execution; baseline tier: fallback.) Tune using: CommandPattern, DeviceType.'
references:
  - https://attack.mitre.org/techniques/T1070/003
author: Shahrukh Khan
date: 2026-05-07
license: MIT
tags:
  - attack.stealth
  - attack.t1070.003

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_builtin_wrapped:
    type: EXECVE
    a0|endswith:
      - '/bash'
      - '/sh'
    a1: '-c'
    a2|contains:
      - 'history -c'
      - 'unset HISTFILE'
      - 'HISTSIZE=0'
  selection_shred:
    type: EXECVE
    a0|endswith: '/shred'
    a1|contains: '.bash_history'
  selection_rm:
    type: EXECVE
    a0|endswith: '/rm'
    a1|contains: '.bash_history'

  condition: 1 of selection_*

falsepositives:
  - Shell configuration scripts or hardened terminal profiles that intentionally disable history for compliance reasons via a wrapped one-liner, though this is uncommon on production systems.

level: high

title: "T1070.003 Indicator Removal: Clear Command History"
id: 1c6f13f2-a62f-477b-8b8c-799beb9b8ce1
description: 'Behavioral Detection of Command History Clearing. (Retargeted to the file_delete ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: LogFilePath, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1070/003
author: Shahrukh Khan
date: 2026-05-17
license: MIT
tags:
  - attack.stealth
  - attack.t1070.003

logsource:
  category: file_delete
  product: esxi
  service: shell

detection:
  selection:
    CommandLine|contains:
      - 'history -c'
      - 'rm -f /root/.ash_history'
      - 'unset HISTFILE'

  condition: selection

falsepositives:
  - Rare legitimate use exists for clearing shell history on shared jump-host ESXi consoles, but this is uncommon and should be treated as suspicious by default.

level: high

Related sub-techniques

• T1070.008 Clear Mailbox Data
• T1070.004 File Deletion
• T1070.007 Clear Network Connection History and Configurations
• T1070.009 Clear Persistence
• T1070.010 Relocate Malware
• T1070.006 Timestomp
• T1070.005 Network Share Connection Removal

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1070.003 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan