Try it using Invoke-Atomic

Indicator Removal on Host: Clear Command History

Description from ATT&CK

In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done.

On Linux and macOS, these command histories can be accessed in a few different ways. While logged in, this command history is tracked in a file pointed to by the environment variable HISTFILE. When a user logs off a system, this information is flushed to a file in the user's home directory called ~/.bash_history. The benefit of this is that it allows users to go back to commands they've used before in different sessions.

Adversaries may delete their commands from these logs by manually clearing the history (history -c) or deleting the bash history file rm ~/.bash_history.

Adversaries may also leverage a Network Device CLI on network devices to clear command history data (clear logging and/or clear history).(Citation: US-CERT-TA18-106A)

On Windows hosts, PowerShell has two different command history providers: the built-in history and the command history managed by the PSReadLine module. The built-in history only tracks the commands used in the current session. This command history is not available to other sessions and is deleted when the session ends.

The PSReadLine command history tracks the commands used in all PowerShell sessions and writes them to a file ($env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt by default). This history file is available to all sessions and contains all past history since the file is not deleted when the session ends.(Citation: Microsoft PowerShell Command History)

Adversaries may run the PowerShell command Clear-History to flush the entire command history from a current PowerShell session. This, however, will not delete/flush the ConsoleHost_history.txt file. Adversaries may also delete the ConsoleHost_history.txt file or edit its contents to hide PowerShell commands they have run.(Citation: Sophos PowerShell command audit)(Citation: Sophos PowerShell Command History Forensics)

Atomic Tests

Atomic Test #1 - Clear Bash history (rm)

Clears bash history via rm

Supported Platforms: linux,macos

auto_generated_guid: a934276e-2be5-4a36-93fd-98adbb5bd4fc

Inputs:

None

Attack Commands: Run with sh!

1
2

rm ~/.bash_history

Atomic Test #2 - Clear sh history (rm)

Clears sh history via rm

Supported Platforms: freebsd

auto_generated_guid: 448893f8-1d5d-4ae2-9017-7fcd73a7e100

Inputs:

None

Attack Commands: Run with sh!

1
2

rm ~/.sh_history

Atomic Test #3 - Clear Bash history (echo)

Clears bash history via echo

Supported Platforms: linux

auto_generated_guid: cbf506a5-dd78-43e5-be7e-a46b7c7a0a11

Inputs:

None

Attack Commands: Run with sh!

1
2

echo "" > ~/.bash_history

Atomic Test #4 - Clear sh history (echo)

Clears sh history via echo

Supported Platforms: freebsd

auto_generated_guid: a4d63cb3-9ed9-4837-9480-5bf6b09a6c96

Inputs:

None

Attack Commands: Run with sh!

1
2

echo "" > ~/.sh_history

Atomic Test #5 - Clear Bash history (cat dev/null)

Clears bash history via cat /dev/null

Supported Platforms: linux,macos

auto_generated_guid: b1251c35-dcd3-4ea1-86da-36d27b54f31f

Inputs:

None

Attack Commands: Run with sh!

1
2

cat /dev/null > ~/.bash_history

Atomic Test #6 - Clear sh history (cat dev/null)

Clears sh history via cat /dev/null

Supported Platforms: freebsd

auto_generated_guid: ecaefd53-6fa4-4781-ba51-d9d6fb94dbdc

Inputs:

None

Attack Commands: Run with sh!

1
2

cat /dev/null > ~/.sh_history

Atomic Test #7 - Clear Bash history (ln dev/null)

Clears bash history via a symlink to /dev/null

Supported Platforms: linux,macos

auto_generated_guid: 23d348f3-cc5c-4ba9-bd0a-ae09069f0914

Inputs:

None

Attack Commands: Run with sh!

1
2

ln -sf /dev/null ~/.bash_history

Atomic Test #8 - Clear sh history (ln dev/null)

Clears sh history via a symlink to /dev/null

Supported Platforms: freebsd

auto_generated_guid: 3126aa7a-8768-456f-ae05-6ab2d4accfdd

Inputs:

None

Attack Commands: Run with sh!

1
2

ln -sf /dev/null ~/.sh_history

Atomic Test #9 - Clear Bash history (truncate)

Clears bash history via truncate

Supported Platforms: linux

auto_generated_guid: 47966a1d-df4f-4078-af65-db6d9aa20739

Inputs:

None

Attack Commands: Run with sh!

1
2

truncate -s0 ~/.bash_history

Atomic Test #10 - Clear sh history (truncate)

Clears sh history via truncate

Supported Platforms: freebsd

auto_generated_guid: e14d9bb0-c853-4503-aa89-739d5c0a5818

Inputs:

None

Attack Commands: Run with sh!

1
2

truncate -s0 ~/.sh_history

Atomic Test #11 - Clear history of a bunch of shells

Clears the history of a bunch of different shell types by setting the history size to zero

Supported Platforms: linux,macos

auto_generated_guid: 7e6721df-5f08-4370-9255-f06d8a77af4c

Inputs:

None

Attack Commands: Run with sh!

1
2
3
4

unset HISTFILE
export HISTFILESIZE=0
history -c

Atomic Test #12 - Clear history of a bunch of shells (freebsd)

Clears the history of a bunch of different shell types by setting the history size to zero

Supported Platforms: freebsd

auto_generated_guid: 9bf7c8af-5e12-42ea-bf6b-b0348fb9dfb0

Inputs:

None

Attack Commands: Run with sh!

1
2
3
4
5
6

unset HISTFILE
unset histfile
export HISTFILESIZE=0
export HISTSIZE=0
history -c

Atomic Test #13 - Clear and Disable Bash History Logging

Clears the history and disable bash history logging of the current shell and future shell sessions

Supported Platforms: linux,macos

auto_generated_guid: 784e4011-bd1a-4ecd-a63a-8feb278512e6

Inputs:

None

Attack Commands: Run with sh!

1
2
3
4
5

set +o history
echo 'set +o history' >> ~/.bashrc
. ~/.bashrc
history -c

Cleanup Commands:

1
2
3
4

sed -i 's/set +o history//g' ~/.bashrc
. ~/.bashrc
set -o history

Atomic Test #14 - Use Space Before Command to Avoid Logging to History

Using a space before a command causes the command to not be logged in the Bash History file

Supported Platforms: linux,macos

auto_generated_guid: 53b03a54-4529-4992-852d-a00b4b7215a6

Inputs:

None

Attack Commands: Run with sh!

1
2
3

hostname
whoami

Atomic Test #15 - Disable Bash History Logging with SSH -T

Keeps history clear and stays out of lastlog,wtmp,btmp ssh -T keeps the ssh client from catching a proper TTY, which is what usually gets logged on lastlog

Supported Platforms: linux

auto_generated_guid: 5f8abd62-f615-43c5-b6be-f780f25790a1

Inputs:

None

Attack Commands: Run with sh!

1
2

sshpass -p 'pwd101!' ssh testuser1@localhost -T hostname

Cleanup Commands:

1
2

userdel -f testuser1

Dependencies: Run with sh!

Description: Install sshpass and create user account used for excuting

Check Prereq Commands:

1
2

$(getent passwd testuser1 >/dev/null) && $(which sshpass >/dev/null)

Get Prereq Commands:

1
2
3
4

/usr/sbin/useradd testuser1
echo -e 'pwd101!\npwd101!' | passwd testuser1
(which yum && yum -y install epel-release sshpass)||(which apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y sshpass)

Atomic Test #16 - Disable sh History Logging with SSH -T (freebsd)

Keeps history clear and stays out of lastlog,wtmp,btmp ssh -T keeps the ssh client from catching a proper TTY, which is what usually gets logged on lastlog

Supported Platforms: freebsd

auto_generated_guid: ec3f2306-dd19-4c4b-bed7-92d20e9b1dee

Inputs:

None

Attack Commands: Run with sh!

1
2

sshpass -p 'pwd101!' ssh testuser1@localhost -T hostname

Cleanup Commands:

1
2

rmuser -y testuser1

Dependencies: Run with sh!

Description: Install sshpass and create user account used for excuting

Check Prereq Commands:

1
2

$(getent passwd testuser1 >/dev/null) && $(which sshpass >/dev/null)

Get Prereq Commands:

1
2
3
4

pw useradd testuser1 -g wheel -s /bin/sh
echo 'pwd101!' | pw mod user testuser1 -h 0
(which pkg && pkg install -y sshpass)

Atomic Test #17 - Prevent Powershell History Logging

Prevents Powershell history

Supported Platforms: windows

auto_generated_guid: 2f898b81-3e97-4abb-bc3f-a95138988370

Inputs:

None

Attack Commands: Run with powershell!

1
2

Set-PSReadlineOption -HistorySaveStyle SaveNothing

Cleanup Commands:

1

Set-PSReadLineOption -HistorySaveStyle SaveIncrementally

Atomic Test #18 - Clear Powershell History by Deleting History File

Clears Powershell history

Supported Platforms: windows

auto_generated_guid: da75ae8d-26d6-4483-b0fe-700e4df4f037

Inputs:

None

Attack Commands: Run with powershell!

1
2

Remove-Item (Get-PSReadlineOption).HistorySavePath

Atomic Test #19 - Set Custom AddToHistoryHandler to Avoid History File Logging

The "AddToHistoryHandler" receives the current command as the $line variable and then returns $true if the line should be written to the history file. Here we simply return $false so nothing gets added to the history file for the current session.

Supported Platforms: windows

auto_generated_guid: 1d0d9aa6-6111-4f89-927b-53e8afae7f94

Inputs:

None

Attack Commands: Run with powershell!

1
2

Set-PSReadLineOption -AddToHistoryHandler { return $false }

Cleanup Commands:

1
2

Set-PSReadLineOption -AddToHistoryHandler $null

source