tfMITRE ATT&CK technique

Prevent Command History Logging T1690

Tactic: Defense Impairment
Platforms: ESXi, Linux, macOS, Network Devices, Windows
Version: 1.0
Created: 14 April 2026
Last modified: 12 May 2026
Contributors: Austin Clark, @c2defense; Emile Kenning, Sophos; Vikas Singh, Sophos

Adversaries may impair command history logging to hide commands they run on a compromised system. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they have done.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups70th pct

Threat groups70th percentile · 64% of ATT&CK techniques have fewer threat groups attributed.

CampaignsTop 17%

Campaigns83rd percentile · 73% of ATT&CK techniques have fewer campaigns recorded.

Tools & malware68th pct

Tools & malware68th percentile · 66% of ATT&CK techniques have fewer tools implementing them.

Detection rules54th pct

Detection rules54th percentile · 49% of ATT&CK techniques have fewer detection rules written.

tfMITRE ATT&CK technique

Prevent Command History Logging T1690

Tactic: Defense Impairment
Platforms: ESXi, Linux, macOS, Network Devices, Windows
Version: 1.0
Created: 14 April 2026
Last modified: 12 May 2026
Contributors: Austin Clark, @c2defense; Emile Kenning, Sophos; Vikas Singh, Sophos

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups70th pct

Threat groups70th percentile · 64% of ATT&CK techniques have fewer threat groups attributed.

CampaignsTop 17%

Campaigns83rd percentile · 73% of ATT&CK techniques have fewer campaigns recorded.

Tools & malware68th pct

Tools & malware68th percentile · 66% of ATT&CK techniques have fewer tools implementing them.

Detection rules54th pct

Detection rules54th percentile · 49% of ATT&CK techniques have fewer detection rules written.

Prevent Command History Logging MITRE reference T1690

70th pctamong all ATT&CK techniques for number of groups

4 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Medusa GroupG1051 ↗

Has removed PowerShell command history through the use of the PSReadLine module by running the PowerShell command Remove-Item (Get-PSReadlineOption).HistorySavePath.1

created 2025-10-151 reference

UNC3886G1048 ↗

Has tampered with and disabled logging services on targeted systems.1

created 2025-05-291 reference

Sea TurtleG1041 ↗

Unset the Bash and MySQL history files on victim systems.1

created 2024-11-201 referenceaka Teal Kurma

APT38G0082 ↗

Has prepended a space to all of their terminal commands to operate without leaving traces in the HISTCONTROL environment.1

created 2019-01-291 referenceaka NICKEL GLADSTONE

All 4 groups for this technique

2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

RedPenguinC0056 ↗

During RedPenguin, UNC3886 used malware to clear the HISTFILE environmental variable and to inject into Junos OS processes to inhibit logging.1 2

2024–2025

ArcaneDoorC0046 ↗

Included disabling logging on targeted Cisco ASA appliances.1 2

2023–2024

All 2 campaigns for this technique

6 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

SPAWNCHIMERAS9024 ↗

Has disabled logging and log forwarding on Ivanti devices targeting the dslogserver process.1 2 3 4

created 2026-04-17MALWARE

BRICKSTORMS9015 ↗

Has impaired command logging through the use of dev/null which prevents generating output from the command and does not wait for input.1

created 2026-04-16MALWARE

VIRTUALPITAS1217 ↗

Can impair logging by setting the HISTFILE environmental variable to 0 and stopping the vmsyslogd service.1

created 2025-06-02MALWAREcarried by 1 group

Line DancerS1186 ↗

Can disable syslog on compromised devices.1

created 2025-01-06MALWARE

BPFDoorS1161 ↗

Sets the MYSQL_HISTFILE and HISTFILE to /dev/null preventing the shell and MySQL from logging history in /proc/<PID>/environ.1

created 2024-09-20MALWARE

SILENTTRINITYS0692 ↗

Can bypass ScriptBlock logging to execute unmanaged PowerShell code from memory.1

created 2022-03-23TOOL

All 6 software entries for this technique

Data component	Name	Channel
Process CreationDC0032	linux:osquery	processes modifying environment variables related to history logging
Command ExecutionDC0064	auditd:SYSCALL	execve calls modifying HISTFILE or HISTCONTROL via unset/export

Data component

Name

Channel

Process CreationDC0032

linux:osquery

processes modifying environment variables related to history logging

Command ExecutionDC0064

auditd:SYSCALL

execve calls modifying HISTFILE or HISTCONTROL via unset/export

Field	What you tune
MonitoredUsers	Specific accounts or groups where history logging must always be enforced.
TimeWindow	Correlation period to detect unset/export of history variables during active shells.

Field

What you tune

MonitoredUsers

Specific accounts or groups where history logging must always be enforced.

TimeWindow

Correlation period to detect unset/export of history variables during active shells.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
Splunk	The following analytic identifies the use of the esxcli system auditrecords commands, which can be used to tamper with logging on an ESXi host. (...)	Generic	stable	-	esxi	VMware ESXi · VMware	Stealth Indicator Removal Defense Impairment Prevent Command History Logging	-	medium	Raven Tait, Splunk	2025-07-11	2026-09-08	c48a155b-2861-417a-813c-220f5272cf01
Splunk	This detection identifies changes to the syslog configuration on an ESXi host using esxcli, which may indicate an attempt to disrupt log collection and evade detection.	Generic	stable	-	esxi	VMware ESXi · VMware	Defense Impairment Prevent Command History Logging	-	medium	Raven Tait, Splunk	2025-07-11	2026-05-13	e530beb9-9b8c-4c9b-9776-0a05521ff32d	-
	Detects changes to the ESXi syslog configuration via "esxcli"	Generic	test	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Hypervisor CLI Defense Impairment Disable or Modify Tools Defense Impairment Prevent Command History Logging	-	medium	Cedric Maurugeon	2023-09-04	—	38eb1dbb-011f-40b1-a126-cf03a0210563

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
Splunk	The following analytic identifies the use of the esxcli system auditrecords commands, which can be used to tamper with logging on an ESXi host. (...)	Generic	stable	-	esxi	VMware ESXi · VMware	Stealth Indicator Removal Defense Impairment Prevent Command History Logging	-	medium	Raven Tait, Splunk	2025-07-11	2026-09-08	c48a155b-2861-417a-813c-220f5272cf01
Splunk	This detection identifies changes to the syslog configuration on an ESXi host using esxcli, which may indicate an attempt to disrupt log collection and evade detection.	Generic	stable	-	esxi	VMware ESXi · VMware	Defense Impairment Prevent Command History Logging	-	medium	Raven Tait, Splunk	2025-07-11	2026-05-13	e530beb9-9b8c-4c9b-9776-0a05521ff32d	-
	Detects changes to the ESXi syslog configuration via "esxcli"	Generic	test	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Hypervisor CLI Defense Impairment Disable or Modify Tools Defense Impairment Prevent Command History Logging	-	medium	Cedric Maurugeon	2023-09-04	—	38eb1dbb-011f-40b1-a126-cf03a0210563

Prevent Command History Logging T1690

Prevent Command History Logging T1690

Prevent Command History Logging MITRE reference T1690

Prevent Command History Logging MITRE reference T1690

Offense vs defense T1690

Prevent Command History Logging detection strategy DET0563

Detection Strategy for Defense Impairment via Prevent Command History Logging across OS platforms.

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Prevent Command History Logging detections T1690

Prevent Command History Logging detections T1690

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Command ExecutionDC0064	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106