attack_technique: T1070.003
display_name: 'Indicator Removal on Host: Clear Command History'
atomic_tests:
- name: Clear Bash history (rm)
  auto_generated_guid: a934276e-2be5-4a36-93fd-98adbb5bd4fc
  description: |
    Clears bash history via rm
  supported_platforms:
  - linux
  - macos
  executor:
    command: |
      rm ~/.bash_history
    name: sh
- name: Clear Bash history (echo)
  auto_generated_guid: cbf506a5-dd78-43e5-be7e-a46b7c7a0a11
  description: |
    Clears bash history via rm
  supported_platforms:
  - linux
  executor:
    command: |
      echo "" > ~/.bash_history
    name: sh
- name: Clear Bash history (cat dev/null)
  auto_generated_guid: b1251c35-dcd3-4ea1-86da-36d27b54f31f
  description: |
    Clears bash history via cat /dev/null
  supported_platforms:
  - linux
  - macos
  executor:
    command: |
      cat /dev/null > ~/.bash_history
    name: sh
- name: Clear Bash history (ln dev/null)
  auto_generated_guid: 23d348f3-cc5c-4ba9-bd0a-ae09069f0914
  description: |
    Clears bash history via a symlink to /dev/null
  supported_platforms:
  - linux
  - macos
  executor:
    command: |
      ln -sf /dev/null ~/.bash_history
    name: sh
- name: Clear Bash history (truncate)
  auto_generated_guid: 47966a1d-df4f-4078-af65-db6d9aa20739
  description: |
    Clears bash history via truncate
  supported_platforms:
  - linux
  executor:
    command: |
      truncate -s0 ~/.bash_history
    name: sh
- name: Clear history of a bunch of shells
  auto_generated_guid: 7e6721df-5f08-4370-9255-f06d8a77af4c
  description: |
    Clears the history of a bunch of different shell types by setting the history size to zero
  supported_platforms:
  - linux
  - macos
  executor:
    command: |
      unset HISTFILE
      export HISTFILESIZE=0
      history -c
    name: sh
- name:  Clear and Disable Bash History Logging
  auto_generated_guid: 784e4011-bd1a-4ecd-a63a-8feb278512e6
  description: |
    Clears the history and disable bash history logging of the current shell and future shell sessions
  supported_platforms:
  - linux
  - macos
  executor:
    command: |
      set +o history
      echo 'set +o history' >> ~/.bashrc
      . ~/.bashrc
      history -c
    cleanup_command: |
      sed -i 's/set +o history//g' ~/.bashrc
      . ~/.bashrc
      set -o history
    name: sh
- name:  Use Space Before Command to Avoid Logging to History
  auto_generated_guid: 53b03a54-4529-4992-852d-a00b4b7215a6
  description: |
    Using a space before a command causes the command to not be logged in the Bash History file
  supported_platforms:
  - linux
  - macos
  executor:
    command: |
       hostname
       whoami
    name: sh

- name:  Disable Bash History Logging with SSH -T
  auto_generated_guid: 5f8abd62-f615-43c5-b6be-f780f25790a1
  description: |
    Keeps history clear and stays out of lastlog,wtmp,btmp ssh -T keeps the ssh client from catching a proper TTY, which is what usually gets logged on lastlog
  supported_platforms:
  - linux
  dependencies:
  - description: |
      Install sshpass and create user account used for excuting
    prereq_command: |
      $(getent passwd testuser1 >/dev/null) && $(which sshpass >/dev/null)
    get_prereq_command: |
      /usr/sbin/useradd testuser1
      echo -e 'pwd101!\npwd101!' | passwd testuser1
      (which yum && yum -y install epel-release sshpass)||(which apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y sshpass)
  executor:
    command: |
      sshpass -p 'pwd101!' ssh testuser1@localhost -T hostname
    cleanup_command: |
      userdel -f testuser1
    name: sh

- name:  Prevent Powershell History Logging
  auto_generated_guid: 2f898b81-3e97-4abb-bc3f-a95138988370
  description: |
    Prevents Powershell history
  supported_platforms:
  - windows
  executor:
    command: |
       Set-PSReadlineOption –HistorySaveStyle SaveNothing
    name: powershell
    cleanup_command: 'Set-PSReadLineOption -HistorySaveStyle SaveIncrementally'
- name:  Clear Powershell History by Deleting History File
  auto_generated_guid: da75ae8d-26d6-4483-b0fe-700e4df4f037
  description: |
    Clears Powershell history
  supported_platforms:
  - windows
  executor:
    command: |
       Remove-Item (Get-PSReadlineOption).HistorySavePath
    name: powershell

