tfMITRE ATT&CK sub-technique

Shell History T1552.003

sub-technique of T1552 Unsecured Credentials

Tactic: Credential Access
Platforms: Linux, macOS, Windows
Version: 2.0
Created: 04 February 2020
Last modified: 24 October 2025
Contributors: Raja Singh (raja-singh-r3v-sh3ll); Avioo360

Adversaries may search the command history on compromised systems for insecurely stored credentials.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware51st pct

Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules60th pct

Detection rules60th percentile · 60% of ATT&CK techniques have this many detection rules written or fewer.

Shell History MITRE reference T1552.003

51st pctamong all ATT&CK techniques for number of tools

2 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

TeamPCP Cloud StealerS9041 ↗

Can target credentials in shell history on self-hosted runners.1

created 2026-07-01MALWAREcarried by 1 group

KinsingS0599 ↗

Has searched bash_history for credentials.1

created 2021-04-06MALWARE

All 2 software entries for this technique

Offense vs defense T1552.003

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 3Splunk ESCU (cumulative) · 1

first rule: 2019 Q3

Shell History detection strategy DET0385

MITRE names one behaviour worth catching for this technique and breaks it into 2 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect Access and Parsing of .bash_history Files for Credential Harvesting

Enterprise

2 platforms

AN1085 · Linux

A process outside of interactive shell context reads ~/.bash_history directly (e.g., using cat, less, grep), often shortly after privilege escalation or user switch (su/sudo). This may be followed by credential scanning in memory or file writes to new locations.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:EXECVE	cat\|less\|grep accessing .bash_history from a non-shell process
File CreationDC0039	auditd:SYSCALL	write or create file after .bash_history access
File AccessDC0055	auditd:SYSCALL	open/read access to ~/.bash_history

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UserContext	Filter by users with elevated privileges or service accounts
TimeWindow	Correlate access to .bash_history within X seconds of user switch or privilege escalation
ProcessNamePatterns	Add/remove CLI utilities used to read bash history

AN1086 · macOS

A process or terminal command outside of standard shell utilities reads the user's .bash_history file. On macOS, unified logs or telemetry tools like EndpointSecurity (ESF) may observe file read APIs or terminal process lineage that shows non-user-initiated access.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process MetadataDC0034	macos:unifiedlog	non-shell process tree accessing bash history
File AccessDC0055	macos:endpointsecurity	open or read syscall to ~/.bash_history

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ParentProcessCheck	Scope access to .bash_history only if parent is not Terminal.app or bash/zsh
AccessFrequency	Raise priority if .bash_history is accessed multiple times in short window

Operating System ConfigurationM1028

There are multiple methods of preventing a user's command history from being flushed to their .bash_history file, including use of the following commands: set +o history and set -o history to start logging again; unset HISTFILE being added to a user's .bash_rc file; and ln -s /dev/null ~/.bash_history to write commands to /dev/null instead. In Zsh, fc -p can be used to create a private history session. However, previous history will be unavailable to the user until the session ends. Using unset HISTFILE and writing commands to /dev/null can also be used, similarly to Bash. In PowerShell, users can utilize Set-PSReadLineOption to modify how commands are saved into history. Setting -HistorySaveStyle SaveNothing prevents command history from being saved onto the file. Note that setting it from SaveNothing to SaveIncrementally in the same session will cause all commands from that session to be saved. Alternatively, -AddToHistoryHandler can be used to filter certain commands from being saved into the history file.

Tests2Executorssh 2Need elevation0 of 2Have prerequisites0Have cleanup0Platformslinux, macos

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Search Through Bash History

linux, macos

—

Search through bash history for specifice commands we want to capture

Input arguments

Name	Type	Default	Description
output_file	path	~/loot.txt	Path where captured results will be placed
bash_history_filename	path	~/.bash_history	Path of the bash history file to capture
bash_history_grep_args	path	-e '-p ' -e 'pass' -e 'ssh'	grep arguments that filter out specific commands we want to capture

Attack command

cat #{bash_history_filename} | grep #{bash_history_grep_args} > #{output_file}

GUID4f25823b-e3f8-4d44-b04c-0f106eac0032

Search Through sh History

linux

—

Search through sh history for specifice commands we want to capture

Input arguments

Name	Type	Default	Description
output_file	path	~/loot.txt	Path where captured results will be placed
sh_history_filename	path	~/.history	Path of the sh history file to capture
sh_history_grep_args	path	-e '-p ' -e 'pass' -e 'ssh'	grep arguments that filter out specific commands we want to capture

Attack command

cat #{sh_history_filename} | grep #{sh_history_grep_args} > #{output_file}

GUIDc44756c9-c63e-4e49-bdb4-13e17ed2397f

Tests from Atomic Red Team (MIT licence) · technique definition

Shell History detections T1552.003

4 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

60th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs