Skip to content

Latest commit

 

History

History
71 lines (35 loc) · 2.31 KB

T1562.003.md

File metadata and controls

71 lines (35 loc) · 2.31 KB

T1562.003 - HISTCONTROL

Description from ATT&CK

Adversaries may configure HISTCONTROL to not log all command history. The HISTCONTROL environment variable keeps track of what should be saved by the history command and eventually into the ~/.bash_history file when a user logs out. HISTCONTROL does not exist by default on macOS, but can be set by the user and will be respected.

This setting can be configured to ignore commands that start with a space by simply setting it to "ignorespace". HISTCONTROL can also be set to ignore duplicate commands by setting it to "ignoredups". In some Linux systems, this is set by default to "ignoreboth" which covers both of the previous examples. This means that “ ls” will not be saved, but “ls” would be saved by history.

Adversaries can abuse this to operate without leaving traces by simply prepending a space to all of their terminal commands.

Atomic Tests


Atomic Test #1 - Disable history collection

Disables history collection in shells

Supported Platforms: Linux, macOS

Inputs:

Name Description Type Default Value
evil_command Command to run after shell history collection is disabled String whoami

Attack Commands: Run with sh!

export HISTCONTROL=ignoreboth
#{evil_command}


Atomic Test #2 - Mac HISTCONTROL

The HISTCONTROL variable is set to ignore (not write to the history file) command that are a duplicate of something already in the history and commands that start with a space. This atomic sets this variable in the current session and also writes it to the current user's ~/.bash_profile so that it will apply to all future settings as well. https://www.linuxjournal.com/content/using-bash-history-more-efficiently-histcontrol

Supported Platforms: macOS, Linux

Run it with these steps!

  1. export HISTCONTROL=ignoreboth
  2. echo export "HISTCONTROL=ignoreboth" >> ~/.bash_profile
  3. ls
  4. whoami > recon.txt