Miasma/MYRA Infostealer Shell History Collection from Developer Workstations

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects processes such as Node.js, npm, or Python accessing sensitive command-line history files including .bash_history, .zsh_history, .fish_history, or ConsoleHost_history.txt. Accessing these files, which often contain credentials or command execution history, is a common indicator of credential harvesting or post-exploitation reconnaissance.