T1552.003 — Shell History

Tactic: Credential Access · Platforms: Linux, macOS, Windows

Adversaries may search the command history on compromised systems for insecurely stored credentials. On Linux and macOS systems, shells such as Bash and Zsh keep track of the commands users type on the command-line with the "history" utility. Once a user logs out, the history is flushed to the…

Sub-technique of Unsecured Credentials (T1552).

Sigma detection rules (2)

T1552.003 Unsecured Credentials: Shell History

title: "T1552.003 Unsecured Credentials: Shell History"
id: 79bf6195-9345-4ea4-be35-d10a5612a073
description: 'Detect Access and Parsing of .bash_history/.zsh_history/.sh_history Files for Credential Harvesting via cat (the /history binary check was dropped since history is a shell builtin rarely captured as a standalone EXECVE record). Suppresses the common self-access case of root reading its own history file; genuine cross-user access by non-root accounts still needs UserContext correlation with uid-to-home-directory mapping outside auditd single-event scope. Tune using: UserContext, TimeWindow, ProcessNamePatterns.'
references:
  - https://attack.mitre.org/techniques/T1552/003
author: Shahrukh Khan
date: 2026-01-09
license: MIT
tags:
  - attack.credential-access
  - attack.t1552.003

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith: '/cat'
    a1|contains:
      - '.bash_history'
      - '.zsh_history'
      - '.sh_history'
  filter_self_root:
    auid: 0
    a1|contains:
      - '/root/.bash_history'
      - '/root/.zsh_history'
      - '/root/.sh_history'

  condition: selection and not filter_self_root

falsepositives:
  - Users legitimately reviewing their own shell history; root reading its own /root/.bash_history is filtered out, but other same-user self-access (e.g., a non-root user cat-ing their own history file) is not distinguishable from cross-user access without additional uid-to-home-directory correlation.

level: medium

T1552.003 Unsecured Credentials: Shell History

title: "T1552.003 Unsecured Credentials: Shell History"
id: e7ba8250-aee2-42a4-9a4c-25038436dc5a
description: 'Detect Access and Parsing of .bash_history Files for Credential Harvesting. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ParentProcessCheck, AccessFrequency.'
references:
  - https://attack.mitre.org/techniques/T1552/003
author: Shahrukh Khan
date: 2026-04-09
license: MIT
tags:
  - attack.credential-access
  - attack.t1552.003

logsource:
  product: macos

detection:
  selection:
    Image|endswith:
      - '/grep'
      - '/cat'
      - '/tail'
  selection_target:
    CommandLine|contains:
      - '.bash_history'
      - '.zsh_history'
  condition: selection and selection_target

falsepositives:
  - Users legitimately review their own shell history for recall of past commands, so this should be scoped to access originating from a process other than the interactive shell itself or repeated access across multiple user home directories.

level: medium

Related sub-techniques

Explore