[BASH] History hiding

alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[BASH] History hiding"; content:"HISTORY"; meta_content: " %sagan%",HISTFILE,HISTFILESIZE,HISTSIZE; classtype:suspicious-command; program:bash
| -bash
| sh
| -sh; sid:5002303; rev:3;)