Linux History File Content Access
Detects attempts to print the contents of common history files (like .bash_history or .zsh_history) using command-line utilities such as `cat`, `head`, `tail`, or `more`. This activity is often performed by adversaries for reconnaissance purposes to gather information about previously executed commands, which may contain sensitive data or reveal system configurations.
Sigma
