Sigma medium test sigma

Suspicious History File Operations

Detects commandline operations on shell history files

View Source

Detection Logic

{
  "selection": {
    "CommandLine
| contains": [
      ".bash_history",
      ".zsh_history",
      ".zhistory",
      ".history",
      ".sh_history",
      "fish_history"
    ]
  },
  "condition": "selection"
}

False Positives

  • ⚠ Legitimate administrative activity
  • ⚠ Legitimate software, cleaning hist file

Field Validations

Loading…

Comments (0)

Loading comments...