Shell history and log removal
A command resembles clearing shell history or deleting, truncating, or shredding selected logs.
Why it is risky
Section titled “Why it is risky”Removing evidence can make unexpected activity harder to investigate and weaken accountability.
Example
Section titled “Example”After running unfamiliar commands, an agent clears the shell history and removes a related log file.
This is a fictional example, not an event from a customer.
What Omnodex Detects
Section titled “What Omnodex Detects”The rule recognizes selected Unix history and log manipulation patterns, including content saved into recognized staged files.
| Rule ID | Event category | Tier | Base severity |
|---|---|---|---|
RULE_THREAT_AUDIT_TRAIL_DESTRUCTION | threat_command | Community | HIGH |
Base severity is the rule default. A finding involving content saved for later execution may have a lower severity. Your loaded rule version and event details determine the finding you see.
What to check next
Section titled “What to check next”Preserve available evidence and compare the cleanup with the task. Review surrounding events; handle accidentally logged secrets through controlled retention and credential rotation procedures.
False positives
Section titled “False positives”Approved cleanup in disposable environments or removal of accidentally logged secrets can match. Legitimate log maintenance requires context.
False negatives
Section titled “False negatives”Other log locations, platform-specific event-log tools, logging disabled before capture, or indirect deletion may be missed.
Technical details
Section titled “Technical details”The pattern does not establish motive or prove that evidence was erased. Review the tool result and remaining logs.
A finding describes a pattern in captured activity. Review the original call, its result, and the task context before concluding that harm occurred. Absence of a finding does not establish that an operation is safe.