Compliance Node Overview
MITRE ATT&CK T1562.003 (Impair Command History Logging) is an Enterprise Defense Evasion sub-technique of T1562 (Impair Defenses). Adversaries may impair command history logging to hide commands they run on a compromised system. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done. On Linux and macOS, command history is tracked in a file pointed to by the environment variable HISTFILE. When a user logs off a system, this information is flushed to a file in the user's home directory called ~/.bash_history. Affected platforms: Linux, macOS, Windows, Network. MITRE-documented mitigations include M1028 Operating System Configuration, M1039 Environment Variable Permissions. The Center for Threat-Informed Defense maps this technique to NIST SP 800-53 Rev 5 controls AC-02, AC-03, AC-05, AC-06, CA-07, CM-02, CM-05, CM-06.
Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated:
Primary source: https://attack.mitre.org/versions/v16/techniques/T1562/003/
SHA-256 integrity: 9912be427f18d40afeb328d27c7eebd8025d6b05a4fe40a6eb223f420c49c4a2
Primary Citations — 7 traced to source
- MITRE ATT&CK Technique T1562.003: Impair Command History Logging (https://attack.mitre.org/versions/v16/techniques/T1562/003/)
- MITRE ATT&CK Tactic TA0005: Defense Evasion (https://attack.mitre.org/tactics/TA0005/)
+ 5 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access