Bash History File Read for Credential Harvesting

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects attempts to read the bash history file, typically using the 'cat ~/.bash_history' command, over a TCP connection to port 22 (SSH). This activity is often associated with credential harvesting by an attacker who has gained access to a system and is looking for sensitive information, such as previously entered commands that might contain passwords or other credentials.