MediumCompromise indicatorsBLWK-EVASION-001

Shell history recording is suppressed

What this means

A shell startup file sets HISTSIZE=0, clears HISTFILE, or unsets it — commands run in that shell leave no trace in history. This is either a deliberate defense-evasion step by an attacker with a shell on the box, or a privacy tweak you made yourself; worth confirming which.

How to fix it

If unrecognized, remove the HISTSIZE/HISTFILE override from ~/.bashrc, ~/.zshrc, or ~/.profile.

Check it yourself

Run a scan and look for BLWK-EVASION-001 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads shell_history_config and reports this check when:

history_suppressed == true

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• MITRE ATT&CK T1070.003

Related checks

• File modified since baseline: ‹path› · BLWK-FIM-001
• File deleted since baseline: ‹path› · BLWK-FIM-002
• Not covered by the file-integrity baseline: ‹path› · BLWK-FIM-003
• Credential file modified since baseline: ‹path› · BLWK-FIM-004
• Credential file deleted since baseline: ‹path› · BLWK-FIM-005
• Credential file not covered by the baseline: ‹path› · BLWK-FIM-006