Description

Retrieves shell command history for all users with anti-forensics detection. Uses LEFT JOIN to identify users with no shell history (potential evidence of history clearing). Review results for: (1) suspicious command patterns including reverse shells, encoded commands, credential access, (2) users with no_history_suspicious='yes' indicating missing history files.

Detection Focus:

• Reverse shell commands (bash -i >& /dev/tcp/, nc -e /bin/sh)
• Base64 encoded commands (echo ... | base64 -d | sh)
• Credential access attempts (cat /etc/passwd, cat ~/.ssh/*)
• Download/transfer tools (curl, wget, scp, rsync)
• History evasion (unset HISTFILE, HISTSIZE=0, history -c)
• Users with no shell history (anti-forensics indicator)

Key Features

Result

Query results include:

• username, uid, gid - User identification
• user_home - User's home directory path
• command - The executed command (NULL if no history)
• history_file - Path to the history file
• shell_type - Detected shell (bash/zsh/fish/ash/unknown)
• command_time - Human-readable timestamp or 'unknown'
• command_timestamp - Raw Unix epoch timestamp
• no_history_suspicious - 'yes' if user has no history (investigate!)

Platform

linux,darwin

Interval

3600 seconds (1 hour)

Query ID

shell_history_linux_macos_elastic

ECS Field Mappings

SQL Query

-- Shell History - Command Execution Forensics with Anti-Forensics Detection
-- MITRE ATT&CK: T1059.004 (Unix Shell), T1552.003 (Bash History), T1070.003 (Clear History), T1105 (Ingress Tool Transfer), T1562.001 (Disable Tools)
-- Platforms: Linux, macOS
-- Uses LEFT JOIN to detect users with no shell history (anti-forensics indicator)
-- Note: Look for suspicious patterns and users with no_history_suspicious='yes'
SELECT
  u.username,
  u.uid,
  u.gid,
  u.directory AS user_home,
  sh.command,
  sh.history_file,
  CASE
    WHEN sh.history_file LIKE '%bash_history%' THEN 'bash'
    WHEN sh.history_file LIKE '%zsh_history%' THEN 'zsh'
    WHEN sh.history_file LIKE '%fish_history%' THEN 'fish'
    WHEN sh.history_file LIKE '%ash_history%' THEN 'ash'
    ELSE 'unknown'
  END AS shell_type,
  CASE
    WHEN sh.time > 0 THEN datetime(sh.time, 'unixepoch')
    ELSE 'unknown'
  END AS command_time,
  sh.time AS command_timestamp,
  CASE
    WHEN sh.command IS NULL THEN 'yes'
    ELSE 'no'
  END AS no_history_suspicious
FROM users u
LEFT JOIN shell_history sh ON sh.uid = u.uid
WHERE (u.uid >= 500 OR sh.command IS NOT NULL)
  AND (sh.command IS NULL OR sh.command != '')
ORDER BY u.username, sh.time DESC