T1070.003

Clear Command History

Index entry

In-depth coverage of this technique (how it looks in telemetry, how to hunt it, and how to rule out benign activity) is coming soon. It's in our catalog and on the roadmap to be written up.

View this technique on MITRE ATT&CK →

Telemetry needed

The log events that help detect this technique, from the Telemetry reference: which log source to collect, which event in it, and how to enable each one.

ESXi and vCenter logs (the log as a whole)
Linux audit framework (auditd)
- PATH Path record
- SYSCALL:execve SYSCALL record for execve
Other macOS sources (fsevents, plists, launchd, TCC, MDM) (the log as a whole)
macOS unified log (the log as a whole)
Network device logs (syslog, CLI/AAA, config, SNMP) (the log as a whole)
PowerShell logging
- 4103 Module logging (pipeline execution)
- 4104 Script block logging (script block text)
- 4105 Script block invocation started
- 4106 Script block invocation completed
Windows Security event log
- 4656 A handle to an object was requested.
- 4663 An attempt was made to access an object.
- 4670 Permissions on an object were changed.
Sysmon
- 23 FileDelete (File Delete archived)