Hello and welcome to another
application of the minor attack
framework discussion today,
we're going to be looking at clear
command history.
So to jump right into
this, the objectives of today's
discussion are as follows.
So we're going to review what clear
command history is within matter
and then we're going to discuss why
we should review
it, why it should be reviewed, why
we should look for the clearing of
commands where those commands
are stored, especially in Linux and
Mac OS.
And we're going to talk a little bit
about some of the limitations of
the Windows command prompt
as well.
We want to look at some mitigation
techniques and we are going
to talk detection techniques
as well.
So let's go ahead and jump right
in.
So clear command history
within the moderate tech framework.
We're looking at both Mac OS and
Linux, primarily the
commands a user enters into the
terminal, are actually kept track of
the primary area for this
information is stored in a hidden
file.
Got Basche underscore history.
So anything that's entered into a
terminal gets put
into this particular file.
Now with this,
this could also include things like
credentials. So if you're using
a credential set that's not
encrypted or if you just are
putting something in plain text,
whatever the case may be, it's
going to go into this file.
So if a threat actor has a way to
scan these files on Linux or Mac
systems, then you
could be looking at an exposure.
Now, a threat actor will clear this
information typically to ensure
the job of tracking their actions is
a little more difficult, something
that we don't mention here, but
we'll mention in the coming
slides. Is that in the windows?
Based systems, the
terminal clears itself
after it is closed, so you don't
have a track of what
those sessions included.
There are some auditing functions
and features that can tell you when
certain things are executed through
the command prompt.
But a verbatim transcript
of what runs through it is not
native in windows.
So it is worth a shot, though, to
review for manipulations
and things of that nature.
So threat actors will likely
put again commands in scripts that
will remove command history.
And so this is things like unset his
file, export his file,
equal zero history dachsie to clear
remove the hidden file.
However, don't let it deter you from
looking to see if there's indicators
of compromise in the terminals
history.
And so if you suspect
that something has happened
and the terminal is cleared
in one of these operating systems
and that you don't have a command
history and you know it should
be recording those commands, then
it's likely.
Windows command problems, again,
typically lose their history as soon
as the session ends.
So not much that can be done
there natively again.
So let's talk about mitigation
techniques.
So within the Linux environments,
we can make the history file
read only so that it can't be
manipulated by standard users and
things of that nature.
We can also ensure that the
users permissions are limited.
And so making sure
that a user can't manipulate files
that they don't have administrative
privilege are necessarily assigned
to the account, making sure that the
file can't be manipulated by the
users.
All of those things are nice, pretty
circle that you
have to put together.
But once you do that, it would
be good to keep that history file
intact. And that could be beneficial
in your troubleshooting efforts.
And it may make finding a threat
actor that much easier.
Now, detection techniques,
any alterations or clearing of
the history file, of course, should
be logged as a suspicious activity
and reviewed again.
The Windows equivalent is
not present, but you can enable
some advanced auditing functions and
features for the command prompt and
through some of the other areas that
we've discussed ways that a threat
actor could use power shell or
the command prompt to run certain
things against services or to create
registry entries, do things of that
nature.
Those things should be logged.
And even though you may not have the
full syntax, if you've got some
bits and pieces, you can put it back
together and kind of understand what
a threat actor was doing on a
system.
So with that in mind, let's go ahead
and jump in to a check on learning.
True or false, the Windows command
line history is persistent between
sessions.
All right, well, if you need some
additional time, please pause the
video and take a moment.
So we've discussed that
the Linux
and Mac OS command line
history is persistent as far
as it gets put into a history
file.
But we have not indicated at
all that the Windows command line
history is persistent between
sessions or several
terminal connections.
And so this is going to be
false. Now, have you managed to
have the terminal open?
There are some ways that you can
actually take that and
view the commands that were put into
that session. But as soon as that
session closes, you lose
that history. So that's unfortunate.
So in summary of today's
discussion, we reviewed clear
command history as far as the vector
in the defense invasion component
of Motter.
We reviewed some mitigation
techniques, such as
limiting permissions in those Linux
based environments to the history
files and ensuring that users
are operating in a method of least
privilege.
And we reviewed some detection
techniques, such as when
history files are cleared or when
manipulations are happening within
those different components.
So with that in mind, I want to
thank you for your time today, and
I look forward to seeing you again
soon.