Impair Defenses: HISTCONTROL

Adversaries may configure HISTCONTROL to not log all command history. The HISTCONTROL environment variable keeps track of what should be saved by the history command and eventually into the ~/.bash_history file when a user logs out. HISTCONTROL does not exist by default on macOS, but can be set by the user and will be respected.

This setting can be configured to ignore commands that start with a space by simply setting it to "ignorespace". HISTCONTROL can also be set to ignore duplicate commands by setting it to "ignoredups". In some Linux systems, this is set by default to "ignoreboth" which covers both of the previous examples. This means that " ls" will not be saved, but "ls" would be saved by history.

Adversaries can abuse this to operate without leaving traces by simply prepending a space to all of their terminal commands.

ID: T1562.003
Sub-technique of:  T1562
Tactic: Defense Evasion
Platforms: Linux, macOS
Permissions Required: User
Data Sources: Authentication logs, Environment variable, File monitoring, Process monitoring
Defense Bypassed: Host forensic analysis, Log analysis
CAPEC ID: CAPEC-13
Version: 1.0
Created: 21 February 2020
Last Modified: 29 March 2020

Mitigations

Mitigation Description
Environment Variable Permissions

Prevent users from changing the HISTCONTROL environment variable. [1]

Operating System Configuration

Make sure that the HISTCONTROL environment variable is set to "ignoredups" instead of "ignoreboth" or "ignorespace".

Detection

Correlating a user session with a distinct lack of new commands in their .bash_history can be a clue to suspicious behavior. Additionally, users checking or changing their HISTCONTROL environment variable is also suspicious.

References