Sigma medium test sigma

Suspicious History File Operations - Linux

Detects commandline operations on shell history files

View Source

Detection Logic

{
  "execve": {
    "type": "EXECVE"
  },
  "history": [
    ".bash_history",
    ".zsh_history",
    ".zhistory",
    ".history",
    ".sh_history",
    "fish_history"
  ],
  "condition": "execve and history"
}

False Positives

  • ⚠ Legitimate administrative activity
  • ⚠ Legitimate software, cleaning hist file

Field Validations

Loading…

Comments (0)

Loading comments...