Suspicious Shell Command History Manipulation
Detects attempts to clear or manipulate the shell command history (e.g., bash) using specific commands often utilized by attackers to conceal their activities. The detection monitors for commands such as deleting specific history entries, redirecting history output to /dev/null, or using escape sequences to clear the terminal buffer.
Microsoft Sentinel (KQL)
