You can use the CommandLineHistory collector to list the bash command-line history from managed Linux and macOS devices.
Note
Apple is now using Zsh as the default shell on macOS. The old bash shell is still included with macOS, and you can switch back to bash if you prefer. Zsh became the default in macOS Catalina.
Field | Type | Description |
|---|---|---|
user | String | The user who runs the command. |
ID | Number | The incremental execution sequence number (number 1 is the first command executed). |
CommandLine | String | The command executed. |
Important
The history of the command line and the number depend on the previous configuration available on each device.
Windows | Linux | macOS |
|---|---|---|
n/a | 3.0 and later | 3.0 and later |
CommandLineHistory where CommandLineHistory command_line contains "service"
This example scenario focuses on spotting the adversary:
The commands run by an adversary leave trails of the type usage or intent they had
Specific software has unique command line parameters that can be used to identify their presence
CommandLineHistory command_line WHERE CommandLineHistory command_line contains "SEKURLSA::" OR CommandLineHistory command_line contains "CRYPTO::" OR CommandLineHistory command_line contains "KERBEROS::" OR CommandLineHistory command_line contains "LSADUMP::" OR CommandLineHistory command_line contains "TOKEN::" OR CommandLineHistory command_line contains "MISC::"
The CommandLineHistory collector gives you the ability to access historical data across your enterprise beyond 30 days.
CommandLineHistory command_line WHERE CommandLineHistory command_line contains "-exec bypass -e" OR CommandLineHistory command_line contains "-NoP -NonI -W Hidden -E" OR CommandLineHistory command_line contains "-noni -nop -w hidden -e" OR CommandLineHistory command_line contains "-nop -w hidden -e" OR CommandLineHistory command_line contains "-nop -w hidden -encodedcommand" OR CommandLineHistory command_line contains "-w hidden -en" OR CommandLineHistory command_line contains "-nop -w hidden -exec bypass -enc" OR CommandLineHistory command_line contains "-nop -exec bypass encodedcommand" OR CommandLineHistory command_line contains "-nop -sta -w 1 -enc" OR CommandLineHistory command_line contains "-nop -w hidden -exec bypass -enc"
CommandLineHistory where CommandLineHistory command_line contains "service"
In some cases, a SOC approaches monitoring through dedicated threat hunting expertise.
This example scenario focuses on spotting the adversary:
The commands run by an adversary leave trails of the type usage or intent they had
Specific software has unique command line parameters that can be used to identify their presence
CommandLineHistory command_line WHERE CommandLineHistory command_line contains "SEKURLSA::" OR CommandLineHistory command_line contains "CRYPTO::" OR CommandLineHistory command_line contains "KERBEROS::" OR CommandLineHistory command_line contains "LSADUMP::" OR CommandLineHistory command_line contains "TOKEN::" OR CommandLineHistory command_line contains "MISC::"
The CommandLineHistory collector gives you the ability to access historical data across your enterprise beyond 30 days.
CommandLineHistory command_line WHERE CommandLineHistory command_line contains "-exec bypass -e" OR CommandLineHistory command_line contains "-NoP -NonI -W Hidden -E" OR CommandLineHistory command_line contains "-noni -nop -w hidden -e" OR CommandLineHistory command_line contains "-nop -w hidden -e" OR CommandLineHistory command_line contains "-nop -w hidden -encodedcommand" OR CommandLineHistory command_line contains "-w hidden -en" OR CommandLineHistory command_line contains "-nop -w hidden -exec bypass -enc" OR CommandLineHistory command_line contains "-nop -exec bypass encodedcommand" OR CommandLineHistory command_line contains "-nop -sta -w 1 -enc" OR CommandLineHistory command_line contains "-nop -w hidden -exec bypass -enc"