Suspicious Shell History File Operations
This rule detects command-line operations that interact with common shell history files on macOS systems. Adversaries often target these files (e.g., .bash_history, .zsh_history) to extract sensitive information such as credentials or commands executed by users, which can aid in further compromise or understanding the environment.
Sigma
