Unsecured Credentials: Shell History
- ID
- T1552.003
- Tactics
- TA0006 Credential Access
- Sub-technique of
- T1552 Unsecured Credentials
- Platforms
- Linux, macOS, Windows
- Data sources
- File Access, Process Creation, File Creation, Process Metadata
- Source
- attack.mitre.org
- MITRE last modified
- 25 Oct 2025
Adversaries may search the command history on compromised systems for insecurely stored credentials.
On Linux and macOS systems, shells such as Bash and Zsh keep track of the commands users type on the command-line with the "history" utility. Once a user logs out, the history is flushed to the user's history file. For each user, this file resides at the same location: for example, ~/.bash_history or ~/.zsh_history. Typically, these files keeps track of the user's last 1000 commands.
On Windows, PowerShell has both a command history that is wiped after the session ends, and one that contains commands used in all sessions and is persistent. The default location for persistent history can be found in %userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt, but command history can also be accessed with Get-History. Command Prompt (CMD) on Windows does not have persistent history.[1][2]
Users often type usernames and passwords on the command-line as parameters to programs, which then get saved to this file when they log out. Adversaries can abuse this by looking through the file for potential credentials.[3]
Detection
- DET0385 Detect Access and Parsing of .bash_history Files for Credential Harvesting
Data components: File Access, Process Creation, File Creation, Process Metadata
Mitigations (1)
- M1028 Operating System Configuration
There are multiple methods of preventing a user's command history from being flushed to their .bash_history file, including use of the following commands:
set +o historyandset -o historyto start logging again;unset HISTFILEbeing added to a user's .bash_rc file; andln -s /dev/null ~/.bash_historyto write commands to/dev/nullinstead.In Zsh,
fc -pcan be used to create a private history session. However, previous history will be unavailable to the user until the session ends. Usingunset HISTFILEand writing commands to/dev/nullcan also be used, similarly to Bash.In PowerShell, users can utilize
Set-PSReadLineOptionto modify how commands are saved into history. Setting-HistorySaveStyle SaveNothingprevents command history from being saved onto the file. Note that setting it fromSaveNothingtoSaveIncrementallyin the same session will cause all commands from that session to be saved. Alternatively,-AddToHistoryHandlercan be used to filter certain commands from being saved into the history file.