CircleCI Atomic Red Team doc generator
52 lines
1.8 KiB
Markdown
52 lines
1.8 KiB
Markdown
# T1148 - HISTCONTROL
|
|
## [Description from ATT&CK](https://attack.mitre.org/wiki/Technique/T1148)
|
|
<blockquote>The <code>HISTCONTROL</code> environment variable keeps track of what should be saved by the <code>history</code> command and eventually into the <code>~/.bash_history</code> file when a user logs out. This setting can be configured to ignore commands that start with a space by simply setting it to "ignorespace". <code>HISTCONTROL</code> can also be set to ignore duplicate commands by setting it to "ignoredups". In some Linux systems, this is set by default to "ignoreboth" which covers both of the previous examples. This means that “ ls” will not be saved, but “ls” would be saved by history. <code>HISTCONTROL</code> does not exist by default on macOS, but can be set by the user and will be respected. Adversaries can use this to operate without leaving traces by simply prepending a space to all of their terminal commands.</blockquote>
|
|
|
|
## Atomic Tests
|
|
|
|
- [Atomic Test #1 - Disable history collection](#atomic-test-1---disable-history-collection)
|
|
|
|
- [Atomic Test #2 - Mac HISTCONTROL](#atomic-test-2---mac-histcontrol)
|
|
|
|
|
|
<br/>
|
|
|
|
## Atomic Test #1 - Disable history collection
|
|
Disables history collection in shells
|
|
|
|
**Supported Platforms:** Linux, macOS
|
|
|
|
|
|
#### Inputs
|
|
| Name | Description | Type | Default Value |
|
|
|------|-------------|------|---------------|
|
|
| evil_command | Command to run after shell history collection is disabled | String | whoami|
|
|
|
|
#### Run it with `sh`!
|
|
```
|
|
export HISTCONTROL=ignoreboth
|
|
ls #{evil_command}
|
|
```
|
|
|
|
|
|
|
|
<br/>
|
|
<br/>
|
|
|
|
## Atomic Test #2 - Mac HISTCONTROL
|
|
|
|
**Supported Platforms:** macOS, Linux
|
|
|
|
|
|
#### Run it with these steps!
|
|
1. export HISTCONTROL=ignoreboth
|
|
2. echo export "HISTCONTROL=ignoreboth" >> ~/.bash_profile
|
|
3. ls
|
|
4. whoami > recon.txt
|
|
|
|
|
|
|
|
|
|
|
|
<br/>
|