Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1562.003_impair-command-history-logging
Adversaries may impair command history logging to hide commands they run on a compromised system.
Passed 20 of 23 test cases with the skill, and 17 of 23 without it.
and 1 more in the full report
3 fixed17 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
In Unix-like systems, what specific environment variable export command is tested in Atomic Test 2 to disable shell history collection?
| Checked | Without skill | With skill |
|---|---|---|
| Identifies 'export HISTSIZE=0' as the command tested for history collection disabling. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1562
Adversaries may impair command history logging to hide commands they run on a compromised system. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done.
On Linux and macOS, command history is tracked in a file pointed to by the environment variable HISTFILE. When a user logs off a system, this information is flushed to a file in the user's home directory called /.bash_history. The HISTCONTROL environment variable keeps track of what should be saved by the history command and eventually into the /.bash_history file when a user logs out. HISTCONTROL does not exist by default on macOS, but can be set by the user and will be respected. The HISTFILE environment variable is also used in some ESXi systems.
Adversaries may clear the history environment variable (unset HISTFILE) or set the command history size to zero (export HISTFILESIZE=0) to prevent logging of commands. Additionally, HISTCONTROL can be configured to ignore commands that start with a space by simply setting it to "ignorespace". HISTCONTROL can also be set to ignore duplicate commands by setting it to "ignoredups". In some Linux systems, this is set by default to "ignoreboth" which covers both of the previous examples. This means that “ ls” will not be saved, but “ls” would be saved by history. Adversaries can abuse this to operate without leaving traces by simply prepending a space to all of their terminal commands.
On Windows systems, the PSReadLine module tracks commands used in all PowerShell sessions and writes them to a file ($env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt by default). Adversaries may change where these logs are saved using Set-PSReadLineOption -HistorySavePath {File Path}. This will cause ConsoleHost_history.txt to stop receiving logs. Additionally, it is possible to turn off logging to this file using the PowerShell command Set-PSReadlineOption -HistorySaveStyle SaveNothing.
Adversaries may also leverage a Network Device CLI on network devices to disable historical command logging (e.g. no logging).
Platforms: ESXi, Linux, macOS, Network Devices, Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Disables history collection in shells
test cases passed, vs 17 / 23 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.