ATT&CK technique
View on MITRE ATT&CK →
T1070.003
Clear Command History
Stealth
15 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Clearing Windows Console History | production | 2026-09-18 |
| elastic | Shell History Clearing via Environment Variables | production | 2026-09-18 |
| elastic | Shell Command-Line History Deletion Detected via Defend for Containers | production | 2026-09-18 |
| elastic | Tampering of Shell Command-Line History | production | 2026-09-18 |
| splunk | Windows ConsoleHost History File Deletion | production | 2026-05-13 |
| splunk | Windows Powershell History File Deletion | production | 2026-05-13 |
| sigma | RunMRU Registry Key Deletion | experimental | 2025-09-25 |
| sigma | RunMRU Registry Key Deletion - Registry | experimental | 2025-09-25 |
| sigma | Linux Command History Tampering | test | 2024-04-17 |
| sigma | Cisco Clear Logs | test | 2023-05-26 |
| sigma | Clearing Windows Console History | test | 2022-12-25 |
| sigma | Clear PowerShell History - PowerShell | test | 2022-12-02 |
| sigma | Clear PowerShell History - PowerShell Module | test | 2022-12-02 |
| sigma | Disable Powershell Command History | test | 2022-08-21 |
| sigma | Suspicious IO.FileStream | test | 2022-03-05 |