tfMITRE ATT&CK sub-technique

Clear Command History T1070.003

sub-technique of T1070 Indicator Removal

Tactic: Stealth
Platforms: ESXi, Linux, macOS, Network Devices, Windows
Version: 2.0
Created: 31 January 2020
Last modified: 12 May 2026
Contributors: Vikas Singh, Sophos; Emile Kenning, Sophos; Austin Clark, @c2defense

In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 21%

Threat groups79th percentile · 79% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware57th pct

Tools & malware57th percentile · 57% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 23%

Detection rules77th percentile · 77% of ATT&CK techniques have this many detection rules written or fewer.

Clear Command History MITRE reference T1070.003

Top 21%of all ATT&CK techniques for number of groups

8 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Medusa GroupG1051 ↗

Has cleared command history by running the PowerShell command Remove-Item (Get-PSReadlineOption).HistorySavePath.1

created 2025-10-151 reference

APT5G1023 ↗

Has cleared the command history on targeted ESXi servers.1

created 2024-02-051 referenceaka Mulberry Typhoon

Aquatic PandaG0143 ↗

Cleared command history in Linux environments to remove traces of activity after operations.1

created 2022-01-181 reference

TeamTNTG0139 ↗

Has cleared command history with history -c.1 2

created 2021-10-012 references

APT41G0096 ↗

Attempted to remove evidence of some of its activity by deleting Bash histories.1

created 2019-09-231 referenceaka Wicked Panda

Magic HoundG0059 ↗

Has removed mailbox export requests from compromised Exchange servers.1

created 2018-01-161 referenceaka TA453

All 8 groups for this technique · 6 newest in this preview

Offense vs defense T1070.003

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 9Splunk ESCU (cumulative) · 2

first rule: 2019 Q1

Clear Command History detection strategy DET0165

MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Behavioral Detection of Command History Clearing

Enterprise

5 platforms

AN0467 · Linux

Detects adversary behavior clearing command history via history -c, deletion or modification of ~/.bash_history, or manipulation of the HISTFILE environment variable post-login.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
File DeletionDC0040	auditd:SYSCALL	PATH

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Detect shell history clearing shortly after login or command execution.
UserContext	Elevated shell sessions (e.g., root or sudo) without command history may be more suspicious.
HistoryFilePath	Bash/Zsh history file paths (e.g., ~/.bash_history, ~/.zsh_history).

AN0468 · macOS

Detects adversary clearing shell history using history -c or deleting/altering ~/.zsh_history or ~/.bash_history. Focus on sessions with missing or wiped history.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	process
File ModificationDC0061	fs:fsusage	unlink, write

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Duration after terminal usage where deletion or modification is considered suspicious.
UserContext	Flag unexpected user activity, especially from users who normally don’t use terminal.
HistoryFilePath	Zsh or Bash history files under the user's home directory.

AN0469 · Windows

Detects PowerShell Clear-History invocation or deletion of ConsoleHost_history.txt to erase past PowerShell session history.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File DeletionDC0040	WinEventLog:Sysmon	EventCode=23
File ModificationDC0061	WinEventLog:Security	EventCode=4663, 4670, 4656
Command ExecutionDC0064	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
HistoryFilePath	Path to PSReadLine file, typically in APPDATA.
UserContext	User account or role performing deletion (e.g., low-priv user deleting history).
CommandPattern	Support detection of `Clear-History` and variations.

AN0470 · ESXi

Detects modification or truncation of /var/log/shell.log used to persist ESXi shell command history. Especially suspicious shortly after login or config changes.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File DeletionDC0040	esxi:shell	/var/log/shell.log

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
LogFilePath	Path to shell command history on ESXi.
TimeWindow	Time range post-login or privileged escalation.

AN0471 · Network Devices

Detects use of clear history or clear logging commands on network device CLI to remove past activity logs.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Command ExecutionDC0064	networkdevice:syslog	CLI command audit

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CommandPattern	Support detection of known variants: 'clear history', 'clear logging', etc.
DeviceType	Router, switch, firewall—may have different CLI behaviors.

1 analytic

Adversaries may attempt to conceal their tracks by deleting the history of commands run within the Powershell console, or turning off history saving to begin with. This analytic looks for several commands that would do this. This does not capture the event if it is done within the console itself; only commandline-based commands are detected. Note that the command to remove the history file directly may very a bit if the history file is not saved in the default path on a particular system.

TypeTTPCoverageLowSubmitted2020

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PSA	Process Spawn Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	exe
process	create	command_line

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

This is a pseudocode representation of the below splunk search.

processes = search Process:Create
clear_commands = filter processes where (
  command_line ="*rm (Get-PSReadlineOption).HistorySavePath*" OR command_line="*del (Get-PSReadlineOption).HistorySavePath*" OR command_line="*Set-PSReadlineOption –HistorySaveStyle SaveNothing*" OR command_line="*Remove-Item (Get-PSReadlineOption).HistorySavePath*")  OR command_linee="del*Microsoft\Windows\Powershell\PSReadline\ConsoleHost_history.txt")
output clear_commands

Look for powershell commands that would clear command history

(index=__your_sysmon_index__ EventCode=1) (CommandLine="*rm (Get-PSReadlineOption).HistorySavePath*" OR CommandLine="*del (Get-PSReadlineOption).HistorySavePath*" OR CommandLine="*Set-PSReadlineOption –HistorySaveStyle SaveNothing*" OR CommandLine="*Remove-Item (Get-PSReadlineOption).HistorySavePath*" OR CommandLine="del*Microsoft\\Windows\\Powershell\\PSReadline\\ConsoleHost_history.txt")

Look for powershell commands that would clear command history

norm_id=WindowsSysmon event_id=1 (command="*rm (Get-PSReadlineOption).HistorySavePath*" OR command="*del (Get-PSReadlineOption).HistorySavePath*" OR command="*Set-PSReadlineOption –HistorySaveStyle SaveNothing*" OR command="*Remove-Item (Get-PSReadlineOption).HistorySavePath*" OR command="del*Microsoft\Windows\Powershell\PSReadline\ConsoleHost_history.txt")

Environment Variable PermissionsM1039

Making the environment variables associated with command history read only may ensure that the history is preserved.

Remote Data StorageM1029

Forward logging of historical data to remote data store and centralized logging solution to preserve historical command line log data.

Restrict File and Directory PermissionsM1022

Preventing users from deleting or writing to certain files can stop adversaries from maliciously altering their ~/.bash_history or ConsoleHost_history.txt files.

Tests14Executorssh 8 · PowerShell 4 · bash 2Need elevation1 of 14Have prerequisites1Have cleanup4Platformslinux, macos, windows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Clear Bash history (rm)

linux, macos

—

Clear Bash history (echo)

linux

—

Clear Bash history (cat dev/null)

linux, macos

—

Clears bash history via cat /dev/null

Input arguments

Name	Type	Default	Description
history_path	path	~/.bash_history	Bash history path

Attack command

cat /dev/null > #{history_path}

GUID33b7bcee-5b36-4802-b129-bdf7fc5415b6

Clear Bash history (ln dev/null)

linux, macos

—

Clears bash history via a symlink to /dev/null

Input arguments

Name	Type	Default	Description
history_path	path	~/.bash_history	Bash history path

Attack command

ln -sf /dev/null #{history_path}

GUID9f2d28c4-a85f-4188-a012-08014000ac47

Clear Bash history (truncate)

linux

—

Clears bash history via truncate

Input arguments

Name	Type	Default	Description
history_path	path	~/.bash_history	Bash history path

Attack command

truncate -s0 #{history_path}

GUID88c1bb76-eb0b-4db9-b118-c898cf936fd6

Clear history of a bunch of shells

linux, macos

—

Clear and Disable Bash History Logging

linux, macos

bash

—

Yes

Use Space Before Command to Avoid Logging to History

linux, macos

—

Disable Bash History Logging with SSH -T

linux

—

Yes

Clear Docker Container Logs

linux

bash

Required

—

Prevent Powershell History Logging

windows

PowerShell

—

Yes

Clear Powershell History by Deleting History File

windows

PowerShell

—

Set Custom AddToHistoryHandler to Avoid History File Logging

windows

PowerShell

—

Yes

Clear PowerShell Session History

windows

PowerShell

—

Tests from Atomic Red Team (MIT licence) · technique definition

Clear Command History detections T1070.003

11 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 23%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs