[BASH] .bash_history access

alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[BASH] .bash_history access"; content:".bash_history"; content:"HISTORY"; classtype: suspicious-command; program: bash
| -bash
| sh
| -sh; sid:5000011; rev:5;)