T1690 — Prevent Command History Logging

Tactic: Defense Impairment · Platforms: ESXi, Linux, macOS, Network Devices, Windows

Adversaries may impair command history logging to hide commands they run on a compromised system. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they have done. On Linux and macOS, command history is tracked in a file pointed to…

Sigma detection rules (5)

title: T1690 Prevent Command History Logging
id: e486b8bd-e9d9-476a-8506-779042774b33
description: 'Detects Windows/PowerShell-side command-history suppression: disabling PSReadLine history persistence (Set-PSReadLineOption -HistorySaveStyle SaveNothing), clearing in-session history (Clear-History), or deleting the ConsoleHost_history.txt file -- the Windows-observable analogue of HISTFILE/HISTCONTROL manipulation on Linux/macOS. Retargeted from Add-MpPreference/ThreatIDDefaultAction, a Windows Defender exclusion setting unrelated to command history logging. Tune using: AllowedPaths.'
references:
  - https://attack.mitre.org/techniques/T1690
author: Shahrukh Khan
date: 2026-02-12
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1690

logsource:
  category: process_creation
  product: windows
  service: powershell

detection:
  selection_disable_history:
    CommandLine|contains|all:
      - 'Set-PSReadLineOption'
      - 'SaveNothing'

  selection_clear_history:
    CommandLine|contains: 'Clear-History'

  selection_delete_history_file:
    CommandLine|contains|all:
      - 'ConsoleHost_history'
      - 'Remove-Item'

  condition: 1 of selection_*

falsepositives:
  - Legitimate IT threat-response-action tuning via approved change management; low confidence on this newer sub-technique's exact scope -- recommend SME validation. Some hardened/shared-workstation baselines intentionally disable PowerShell history for compliance reasons.

level: high

title: T1690 Prevent Command History Logging
id: d091a036-5fe3-40e7-89d8-cf644fcb5adb
description: 'T1690 Prevent Command History Logging: detects actual shell-history tampering rather than auditd/systemd service state changes (which are Impair Defenses, not this technique). Catches (a) a shell -c invocation whose command text unsets/zeroes the history environment (unset HISTFILE, HISTFILESIZE=0, HISTSIZE=0, HISTCONTROL=ignoreboth/ignorespace/ignoredups, export HISTFILE=/dev/null, history -c) and (b) symlinking ~/.bash_history to /dev/null via ln -s. Tune using: MonitoredUsers, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1690
author: Shahrukh Khan
date: 2026-05-16
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1690

logsource:
  category: process_creation
  product: linux

detection:
  selection_shell:
    type: EXECVE
    a0|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/zsh'
    a1: '-c'
  selection_history_tamper:
    a2|contains:
      - 'unset HISTFILE'
      - 'HISTFILESIZE=0'
      - 'HISTSIZE=0'
      - 'HISTCONTROL=ignoreboth'
      - 'HISTCONTROL=ignorespace'
      - 'HISTCONTROL=ignoredups'
      - 'HISTFILE=/dev/null'
      - 'history -c'
  selection_symlink_v1:
    type: EXECVE
    a0|endswith: '/ln'
    a1|contains: '-s'
    a2|contains: '/dev/null'
    a3|contains: '.bash_history'
  selection_symlink_v2:
    type: EXECVE
    a0|endswith: '/ln'
    a1|contains: '-s'
    a2|contains: '.bash_history'
    a3|contains: '/dev/null'
  condition: (selection_shell and selection_history_tamper) or selection_symlink_v1 or selection_symlink_v2

falsepositives:
  - Admins intentionally clearing or reconfiguring shell history for legitimate reasons (e.g. before screen-sharing, compliance-driven history redaction) within an authorized change window.

level: high

title: T1690 Prevent Command History Logging
id: 7673c20a-5f3a-45d4-a9a0-5e929ad28bb5
description: 'Detection Strategy for Defense Impairment via Prevent Command History Logging across OS platforms.. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ShellProfiles.'
references:
  - https://attack.mitre.org/techniques/T1690
author: Shahrukh Khan
date: 2026-06-26
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1690

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/bash'
      - '/zsh'
    CommandLine|contains:
      - 'unset HISTFILE'
      - 'HISTSIZE=0'
      - 'set +o history'

  condition: selection

falsepositives:
  - Some security-conscious administrators intentionally disable shell history logging in their own interactive sessions for privacy reasons unrelated to malicious intent.

level: medium

title: T1690 Prevent Command History Logging
id: 74a90814-0657-487f-9d08-c97665d9c442
description: 'Detection Strategy for Defense Impairment via Prevent Command History Logging across OS platforms. Checks a2 (the actual command string passed to bash/sh -c) rather than a1 (which is typically just the -c flag) for HISTFILE/HISTSIZE tampering, and also flags HISTCONTROL=ignorespace/ignoreboth abuse. (Data Component: Command Execution; baseline tier: fallback.) Tune using: DeviceVendors.'
references:
  - https://attack.mitre.org/techniques/T1690
author: Shahrukh Khan
date: 2026-04-14
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1690

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_unset:
    type: EXECVE
    a0|endswith:
      - '/bash'
      - '/sh'
    a1: '-c'
    a2|contains:
      - 'unset HISTFILE'
      - 'HISTSIZE=0'
      - 'export HISTFILE=/dev/null'
      - 'HISTCONTROL=ignorespace'
      - 'HISTCONTROL=ignoreboth'
      - 'HISTCONTROL=ignoreboth:ignorespace'
  selection_clear:
    type: EXECVE
    a0|endswith: '/history'
    a1|contains: '-c'

  condition: 1 of selection_*

falsepositives:
  - Some hardened shell profiles intentionally disable history or set HISTCONTROL=ignoreboth for shared or jump-host accounts as a matter of policy rather than malicious intent; the history -c builtin branch rarely fires since shell builtins are not normally captured as separate EXECVE records.

level: medium

title: T1690 Prevent Command History Logging
id: 3f8764dc-1640-406c-ab44-e3f6fda00f8d
description: 'Detection Strategy for Defense Impairment via Prevent Command History Logging across OS platforms.. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AdminSessions.'
references:
  - https://attack.mitre.org/techniques/T1690
author: Shahrukh Khan
date: 2026-05-03
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1690

logsource:
  category: process_creation
  product: esxi

detection:
  selection:
    CommandLine|contains:
      - 'vim-cmd vimsvc/sessionmgr/kill_session'
      - 'vim-cmd vimsvc/sessionmgr/killsession'

  condition: selection

falsepositives:
  - Administrators intentionally terminating stale or duplicate management sessions during troubleshooting; correlate against AdminSessions to distinguish routine cleanup from an attacker forcing out a legitimate defender session.

level: high

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1690 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan