{"id":"T1070.003","name":"Clear Command History","url":"https://attack.mitre.org/techniques/T1070/003","tactics":["stealth"],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0165","stix_id":"x-mitre-detection-strategy--dcc65927-b113-4f42-b7bd-adb6caebf24a","name":"Behavioral Detection of Command History Clearing","url":"https://attack.mitre.org/detectionstrategies/DET0165","analytics":[{"id":"AN0467","stix_id":"x-mitre-analytic--0ebcdeba-7b02-4f1c-96c9-a602b3663446","name":"Analytic 0467","description":"Detects adversary behavior clearing command history via `history -c`, deletion or modification of ~/.bash_history, or manipulation of the HISTFILE environment variable post-login.","url":"https://attack.mitre.org/detectionstrategies/DET0165#AN0467","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"PATH","data_component":"DC0040","data_component_name":"File Deletion","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"TimeWindow","description":"Detect shell history clearing shortly after login or command execution."},{"field":"UserContext","description":"Elevated shell sessions (e.g., root or sudo) without command history may be more suspicious."},{"field":"HistoryFilePath","description":"Bash/Zsh history file paths (e.g., ~/.bash_history, ~/.zsh_history)."}],"live":true,"detection_strategies":["DET0165"],"techniques":["T1070.003"]},{"id":"AN0468","stix_id":"x-mitre-analytic--9199891a-1543-4f51-be59-4fffb03dfd43","name":"Analytic 0468","description":"Detects adversary clearing shell history using `history -c` or deleting/altering ~/.zsh_history or ~/.bash_history. Focus on sessions with missing or wiped history.","url":"https://attack.mitre.org/detectionstrategies/DET0165#AN0468","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"process","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"fs:fsusage","channel":"unlink, write","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"fs-fsusage"}],"mutable_elements":[{"field":"TimeWindow","description":"Duration after terminal usage where deletion or modification is considered suspicious."},{"field":"UserContext","description":"Flag unexpected user activity, especially from users who normally don’t use terminal."},{"field":"HistoryFilePath","description":"Zsh or Bash history files under the user's home directory."}],"live":true,"detection_strategies":["DET0165"],"techniques":["T1070.003"]},{"id":"AN0469","stix_id":"x-mitre-analytic--01b79770-a269-4b4d-bf09-a4760bae9c94","name":"Analytic 0469","description":"Detects PowerShell `Clear-History` invocation or deletion of `ConsoleHost_history.txt` to erase past PowerShell session history.","url":"https://attack.mitre.org/detectionstrategies/DET0165#AN0469","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"wineventlog-powershell"},{"name":"WinEventLog:Sysmon","channel":"EventCode=23","data_component":"DC0040","data_component_name":"File Deletion","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Security","channel":"EventCode=4663, 4670, 4656","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"wineventlog-security"}],"mutable_elements":[{"field":"HistoryFilePath","description":"Path to PSReadLine file, typically in APPDATA."},{"field":"UserContext","description":"User account or role performing deletion (e.g., low-priv user deleting history)."},{"field":"CommandPattern","description":"Support detection of `Clear-History` and variations."}],"live":true,"detection_strategies":["DET0165"],"techniques":["T1070.003"]},{"id":"AN0470","stix_id":"x-mitre-analytic--d17e0719-d338-47eb-a5b4-8616749584cf","name":"Analytic 0470","description":"Detects modification or truncation of `/var/log/shell.log` used to persist ESXi shell command history. Especially suspicious shortly after login or config changes.","url":"https://attack.mitre.org/detectionstrategies/DET0165#AN0470","platforms":["ESXi"],"log_source_references":[{"name":"esxi:shell","channel":"/var/log/shell.log","data_component":"DC0040","data_component_name":"File Deletion","log_source_slug":"esxi-shell"}],"mutable_elements":[{"field":"LogFilePath","description":"Path to shell command history on ESXi."},{"field":"TimeWindow","description":"Time range post-login or privileged escalation."}],"live":true,"detection_strategies":["DET0165"],"techniques":["T1070.003"]},{"id":"AN0471","stix_id":"x-mitre-analytic--7879313f-abf1-487a-b4d3-813f385ddce3","name":"Analytic 0471","description":"Detects use of `clear history` or `clear logging` commands on network device CLI to remove past activity logs.","url":"https://attack.mitre.org/detectionstrategies/DET0165#AN0471","platforms":["Network Devices"],"log_source_references":[{"name":"networkdevice:syslog","channel":"CLI command audit","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"networkdevice-syslog"}],"mutable_elements":[{"field":"CommandPattern","description":"Support detection of known variants: 'clear history', 'clear logging', etc."},{"field":"DeviceType","description":"Router, switch, firewall—may have different CLI behaviors."}],"live":true,"detection_strategies":["DET0165"],"techniques":["T1070.003"]}],"live":true,"version":"1.0","techniques":["T1070.003"]}],"sigma_rules":[{"id":"26b692dc-1722-49b2-b496-a8258aa6371d","title":"Clear PowerShell History - PowerShell","author":"Ilyas Ochkov, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community","status":"test","level":"medium","date":"2022-01-25","modified":"2022-12-02","description":"Detects keywords that could indicate clearing PowerShell history","references":["https://gist.github.com/hook-s3c/7363a856c3cdbadeb71085147f042c1a"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1070.003"],"path":"rules/windows/powershell/powershell_script/posh_ps_clear_powershell_history.yml","techniques":["T1070.003"],"cves":[]},{"id":"3a9b8c1e-5b2e-4f7a-9d1c-2a7f3b6e1c55","title":"RunMRU Registry Key Deletion - Registry","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-09-25","modified":null,"description":"Detects attempts to delete the RunMRU registry key, which stores the history of commands executed via the run dialog.\nIn the clickfix techniques, the phishing lures instruct users to open a run dialog through (Win + R) and execute malicious commands.\nAdversaries may delete this key to cover their tracks after executing commands.\n","references":["https://www.zscaler.com/blogs/security-research/coldriver-updates-arsenal-baitswitch-and-simplefix"],"logsource":{"product":"windows","category":"registry_delete"},"tags":["attack.stealth","attack.t1070.003"],"path":"rules/windows/registry/registry_delete/registry_delete_runmru.yml","techniques":["T1070.003"],"cves":[]},{"id":"602f5669-6927-4688-84db-0d4b7afb2150","title":"Disable Powershell Command History","author":"Ali Alwashali","status":"test","level":"high","date":"2022-08-21","modified":null,"description":"Detects scripts or commands that disabled the Powershell command history by removing psreadline module","references":["https://twitter.com/DissectMalware/status/1062879286749773824"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1070.003"],"path":"rules/windows/powershell/powershell_script/posh_ps_disable_psreadline_command_history.yml","techniques":["T1070.003"],"cves":[]},{"id":"70ad982f-67c8-40e0-a955-b920c2fa05cb","title":"Suspicious IO.FileStream","author":"frack113","status":"test","level":"medium","date":"2022-01-09","modified":"2022-03-05","description":"Open a handle on the drive volume via the \\\\.\\ DOS device path specifier and perform direct access read of the first few bytes of the volume.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1006/T1006.md"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1070.003"],"path":"rules/windows/powershell/powershell_script/posh_ps_susp_iofilestream.yml","techniques":["T1070.003"],"cves":[]},{"id":"bde47d4b-9987-405c-94c7-b080410e8ea7","title":"Clearing Windows Console History","author":"Austin Songer @austinsonger","status":"test","level":"high","date":"2021-11-25","modified":"2022-12-25","description":"Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.","references":["https://stefanos.cloud/blog/kb/how-to-clear-the-powershell-command-history/","https://www.shellhacks.com/clear-history-powershell/","https://community.sophos.com/sophos-labs/b/blog/posts/powershell-command-history-forensics"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1070","attack.t1070.003"],"path":"rules/windows/powershell/powershell_script/posh_ps_clearing_windows_console_history.yml","techniques":["T1070","T1070.003"],"cves":[]},{"id":"c11aecef-9c37-45a6-9c07-bc0782f963fd","title":"RunMRU Registry Key Deletion","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-09-25","modified":null,"description":"Detects deletion of the RunMRU registry key, which stores the history of commands executed via the Run dialog.\nIn the clickfix techniques, the phishing lures instruct users to open a run dialog through (Win + R) and execute malicious commands.\nAdversaries may delete this key to cover their tracks after executing commands.\n","references":["https://www.zscaler.com/blogs/security-research/coldriver-updates-arsenal-baitswitch-and-simplefix"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1070.003"],"path":"rules/windows/process_creation/proc_creation_win_reg_delete_runmru.yml","techniques":["T1070.003"],"cves":[]},{"id":"ceb407f6-8277-439b-951f-e4210e3ed956","title":"Cisco Clear Logs","author":"Austin Clark","status":"test","level":"high","date":"2019-08-12","modified":"2023-05-26","description":"Clear command history in network OS which is used for defense evasion","references":["https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/command/reference/sysmgmt/n5k-sysmgmt-cr/n5k-sm_cmds_c.html","https://www.cisco.com/c/en/us/td/docs/ios/12_2sr/12_2sra/feature/guide/srmgtint.html#wp1127609"],"logsource":{"product":"cisco","service":"aaa"},"tags":["attack.stealth","attack.t1070.003"],"path":"rules/network/cisco/aaa/cisco_cli_clear_logs.yml","techniques":["T1070.003"],"cves":[]},{"id":"f99276ad-d122-4989-a09a-d00904a5f9d2","title":"Clear PowerShell History - PowerShell Module","author":"Ilyas Ochkov, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community","status":"test","level":"medium","date":"2019-10-25","modified":"2022-12-02","description":"Detects keywords that could indicate clearing PowerShell history","references":["https://gist.github.com/hook-s3c/7363a856c3cdbadeb71085147f042c1a"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.stealth","attack.t1070.003"],"path":"rules/windows/powershell/powershell_module/posh_pm_clear_powershell_history.yml","techniques":["T1070.003"],"cves":[]},{"id":"fdc88d25-96fb-4b7c-9633-c0e417fdbd4e","title":"Linux Command History Tampering","author":"Patrick Bareiss","status":"test","level":"high","date":"2019-03-24","modified":"2024-04-17","description":"Detects commands that try to clear or tamper with the Linux command history.\nThis technique is used by threat actors in order to evade defenses and execute commands without them being recorded in files such as \"bash_history\" or \"zsh_history\".\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.003/T1070.003.md","https://www.hackers-arise.com/post/2016/06/20/covering-your-bash-shell-tracks-antiforensics","https://www.cadosecurity.com/spinning-yarn-a-new-linux-malware-campaign-targets-docker-apache-hadoop-redis-and-confluence/"],"logsource":{"product":"linux"},"tags":["attack.stealth","attack.t1070.003"],"path":"rules/linux/builtin/lnx_shell_clear_cmd_history.yml","techniques":["T1070.003"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}