Linux Command History Tampering
Detects commands that attempt to clear or tamper with the Linux command history. This technique is often used by threat actors to evade detection and execute commands without leaving a record in files like "bash_history" or "zsh_history". The rule specifically looks for various commands and patterns used to delete, truncate, or otherwise manipulate history files, as well as the specific log message "empty_bash_history" which can be generated by a provided monitoring script.
Sigma
