Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add "Clear Command History" attack technique (T1146) #794

Closed
shreyamalviya opened this issue Aug 19, 2020 · 0 comments · Fixed by #799
Closed

Add "Clear Command History" attack technique (T1146) #794

shreyamalviya opened this issue Aug 19, 2020 · 0 comments · Fixed by #799
Assignees
Labels
Feature Issue that describes a new feature to be implemented.

Comments

@shreyamalviya
Copy link
Contributor

shreyamalviya commented Aug 19, 2020

T1146

Adversaries may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.

Adding it as PBA:
- LINUX: 2 PBAs mapped to the same technique -
1. store value of $HISTFILE temporarily, try to unset HISTFILE (this makes it not store any subsequent commands); restore original [HISTFILE doesn't exist for non-interactive shells, can't do this in a script for all shells]
2. store shell history files temporarily, try clearing them; restore original (implementation would be similar to "modify shell startup files" PBA)

- WINDOWS: not applicable (Windows doesn't store commands)

Mapping the technique to the ATT&CK matrix

@shreyamalviya shreyamalviya added Monkey Feature Issue that describes a new feature to be implemented. labels Aug 19, 2020
@shreyamalviya shreyamalviya self-assigned this Aug 19, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Feature Issue that describes a new feature to be implemented.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant