TA0006 · CREDENTIAL ACCESS
Bash History
Adversaries may search the bash command history on compromised systems for insecurely stored credentials. Bash keeps track of the commands users type on the command-line with the "history" utility.
Detect it with
Monitoring when the user's .bash_history is read can help alert to suspicious activity. While users do typically rely on their history of commands, they often access this history through other utilities like "history" instead of commands like cat ~/.bash_history .
Why it matters on shift
Bash History is one of the concrete ways adversaries achieve credential access. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After credential access, the next tactic is usually Discovery. Search your telemetry for the transition before closing the ticket.
Kill-chain context