LiveActive security incident?Get immediate response
MITRE ATT&CK® Technique

T1690: Prevent Command History Logging

Adversaries may impair command history logging to hide commands they run on a compromised system. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they have done.

On Linux and macOS, command history is tracked in a file pointed to by the environment variable `HISTFILE`. When a user logs off a system, this information is flushed to a file in the user's home directory called `~/.bash_history`. The `HISTCONTROL` environment variable keeps track of what should be saved by the history command and eventually into the `~/.bash_history` file when a user logs out. `HISTCONTROL` does not exist by default on macOS, but can be set by the user and will be respected. The `HISTFILE` environment variable is also used in some ESXi systems.[1]

Adversaries may clear the history environment variable (`unset HISTFILE`) or set the command history size to zero (`export HISTFILESIZE=0`) to prevent logging of commands. Additionally, `HISTCONTROL` can be configured to ignore commands that start with a space by simply setting it to "ignorespace". `HISTCONTROL` can also be set to ignore duplicate commands by setting it to "ignoredups". In some Linux systems, this is set by default to "ignoreboth" which covers both of the previous examples. This means that " ls" will not be saved, but "ls" would be saved by history. Adversaries can abuse this to operate without leaving traces by simply prepending a space to all of their terminal commands.

On Windows systems, the `PSReadLine` module tracks commands used in all PowerShell sessions and writes them to a file (`$env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt` by default). Adversaries may change where these logs are saved using `Set-PSReadLineOption -HistorySavePath {File Path}`. This will cause `ConsoleHost_history.txt` to stop receiving logs. Additionally, it is possible to turn off logging to this file using the PowerShell command `Set-PSReadlineOption -HistorySaveStyle SaveNothing`.[2][3]

Adversaries may also leverage a Network Device CLI on network devices to disable historical command logging (e.g. `no logging`).

EnterpriseT1690TechniqueObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Preventing command history logging matters because it removes one of the simplest forensic records of hands-on-keyboard activity. For executives and security leaders, this is less about shell history itself and more about incident confidence: if attackers can suppress local command records on Windows, Linux, macOS, ESXi, or network devices, responders may lose visibility into what was changed, what credentials or systems were touched, and how quickly operations can be trusted again.

Executive priority

Treat this as a defense-impairment behavior that affects investigation quality and operational resilience. Priority should be highest where administrators manage critical infrastructure, virtualization platforms, network devices, financial systems, or other high-value environments through interactive shells. Leaders should ask whether SOC and IR teams rely too heavily on local command history, whether independent process/session logging exists, and whether hardening evidence can be shown for environment variable permissions and operating system configuration.

Technical view

For SOC, detection engineering, and IR teams, validate coverage across the stated platforms: ESXi, Linux, macOS, Network Devices, and Windows. ATT&CK provides no official detection text, but the relationship to DET0563 indicates a detection strategy exists for defense impairment via command history logging across OS platforms. Practical validation should focus on whether changes to shell history behavior, PowerShell PSReadLine history behavior, environment variables such as HISTFILE/HISTCONTROL, history file paths or sizes, and network device logging settings are visible outside the potentially impaired local history file. During response, absence or truncation of command history should be treated as an investigative signal, not proof of benign activity.

Likely telemetry

  • Process creation and command-line telemetry from endpoints and servers
  • Shell session records and terminal audit logs where available
  • PowerShell configuration and history-related telemetry, including PSReadLine history path/style changes
  • File metadata and access events for shell history files such as user command history files on Linux/macOS and PowerShell ConsoleHost history files on Windows
  • Environment variable and shell profile configuration changes, including user startup files that influence history behavior

Detection direction

  • Do not depend on local command history as the primary record of administrator or adversary activity; validate independent process, session, and configuration telemetry.
  • Tune for suspicious changes that reduce, redirect, or disable command history logging, while accounting for legitimate administrator hardening, privacy, automation, or troubleshooting practices.
  • Compare expected administrative baselines against observed history settings on Linux, macOS, Windows PowerShell, ESXi, and network devices.
  • Investigate mismatches such as active administrative sessions with missing, empty, redirected, or unexpectedly stale history records.
  • Use relationship context to prioritize detection validation around network devices, ESXi/Linux, and Windows where related campaigns, groups, and software are documented as using this technique.

Mitigation priorities

  • Harden operating system and platform configuration so command/session logging expectations are defined, centrally managed, and auditable.
  • Restrict modification of environment variables and shell/profile configuration files to authorized users and processes, consistent with M1039 Environment Variable Permissions.
  • Use M1028 Operating System Configuration to standardize secure defaults for shells, PowerShell behavior, ESXi administration, and network device logging where applicable.
  • Centralize administrative logs so local history suppression does not eliminate investigative evidence.
  • Review administrator workflows and service accounts to ensure legitimate tooling does not routinely disable or redirect history without documented approval.
Additional notes and limits

This technique replaces older ATT&CK content related to HISTCONTROL and Impair Command History Logging, expanding the framing across ESXi, Linux, macOS, Network Devices, and Windows. Relationship context shows use by multiple campaigns, groups, and software entries, including activity involving network devices, ESXi/Linux, and Windows-capable tooling. That context should guide prioritization, but local exposure depends on the organization’s actual administrative platforms and logging architecture.

The official ATT&CK object does not provide detection guidance, so recommendations here are derived from the official description, platforms, external references, and listed relationships only. This take does not assert active exploitation against any organization or guaranteed detection coverage. Teams must validate telemetry availability and approved administrative behavior in their own environment.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Prevent Command History Logging

Adversaries may impair command history logging to hide commands they run on a compromised system. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they have done.

On Linux and macOS, command history is tracked in a file pointed to by the environment variable `HISTFILE`. When a user logs off a system, this information is flushed to a file in the user's home directory called `~/.bash_history`. The `HISTCONTROL` environment variable keeps track of what should be saved by the history command and eventually into the `~/.bash_history` file when a user logs out. `HISTCONTROL` does not exist by default on macOS, but can be set by the user and will be respected. The `HISTFILE` environment variable is also used in some ESXi systems.[1]

Adversaries may clear the history environment variable (`unset HISTFILE`) or set the command history size to zero (`export HISTFILESIZE=0`) to prevent logging of commands. Additionally, `HISTCONTROL` can be configured to ignore commands that start with a space by simply setting it to "ignorespace". `HISTCONTROL` can also be set to ignore duplicate commands by setting it to "ignoredups". In some Linux systems, this is set by default to "ignoreboth" which covers both of the previous examples. This means that " ls" will not be saved, but "ls" would be saved by history. Adversaries can abuse this to operate without leaving traces by simply prepending a space to all of their terminal commands.

On Windows systems, the `PSReadLine` module tracks commands used in all PowerShell sessions and writes them to a file (`$env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt` by default). Adversaries may change where these logs are saved using `Set-PSReadLineOption -HistorySavePath {File Path}`. This will cause `ConsoleHost_history.txt` to stop receiving logs. Additionally, it is possible to turn off logging to this file using the PowerShell command `Set-PSReadlineOption -HistorySaveStyle SaveNothing`.[2][3]

Adversaries may also leverage a Network Device CLI on network devices to disable historical command logging (e.g. `no logging`).

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

2 rows
DomainIDNameRelationship / procedure
EnterpriseT1562.003Impair Command History LoggingSub-techniqueImpair Command History Logging revoked by this object.
EnterpriseT1148HISTCONTROLHISTCONTROL revoked by this object.
Associated objects

Groups, software, and campaigns

GroupEnterprise

G1041: Sea Turtle

Sea Turtle is a Türkiye-linked threat actor active since at least 2017 performing espionage and service provider compromise operations against victims in Asia, Europe, and North America. Sea Turtle is notable for targeting registrars managing ccTLDs and complex DNS-based intrusions where the threat actor compromised DNS providers to hijack DNS resolution for ultimate victims, enabling Sea Turtle to spoof log in portals and other applications for credential collection.[1][2][3][4]

GroupEnterprise

G1048: UNC3886

UNC3886 is a China-nexus cyberespionage group that has been active since at least 2022, targeting defense, technology, and telecommunication organizations located in the United States and the Asia-Pacific-Japan (APJ) regions. UNC3886 has displayed a deep understanding of edge devices and virtualization technologies through the exploitation of zero-day vulnerabilities and the use of novel malware families and utilities.[1][2]

GroupEnterprise

G0082: APT38

APT38 is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau.[1] Active since at least 2014, APT38 has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, during which APT38 stole $81 million, as well as attacks against Bancomext [2] and Banco de Chile [2]; some of their attacks have been destructive.[1][2][3][4]

North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.

GroupEnterprise

G1051: Medusa Group

Medusa Group has been active since at least 2021 and was initially operated as a closed ransomware group before evolving into a Ransomware-as-a-Service (RaaS) operation. Some reporting indicates that certain attacks may still be conducted directly by the ransomware’s core developers. Public sources have also referred to the group as “Spearwing” or “Medusa Actors.” [1] [2] Medusa Group employs living-off-the-land techniques, frequently leveraging publicly available tools and common remote management software to conduct operations. The group engages in double extortion tactics, exfiltrating data prior to encryption and threatening to publish stolen information if ransom demands are not met. [3] For initial access, Medusa Group has exploited publicly known vulnerabilities, conducted phishing campaigns, and used credentials or access purchased from Initial Access Brokers (IABs). The group is opportunistic and has targeted a wide range of sectors globally. [4]

MalwareEnterprise

S9015: BRICKSTORM

BRICKSTORM is a cross-platform backdoor with variants written in Go and Rust that facilitates command and control, the ingress transfer of other malware, and the exfiltration of data.[1][2][3][4] BRICKSTORM has also been created from a .NET application using ahead-of-time (AOT) compilation to blend in within victim environments.[1] BRICKSTORM was first observed in April 2024.[5] BRICKSTORM has previously been leveraged by People's Republic of China (PRC) state-nexus actors identified as UNC6201, UNC5221, WARP PANDA, PunyToad, and SYLVANITE.[6][7][1][8][9][10][3][4]

ESXiLinuxNetwork Devices
ToolEnterprise

S0692: SILENTTRINITY

SILENTTRINITY is an open source remote administration and post-exploitation framework primarily written in Python that includes stagers written in Powershell, C, and Boo. SILENTTRINITY was used in a 2019 campaign against Croatian government agencies by unidentified cyber actors.[1][2]

Windows
MalwareEnterprise

S9024: SPAWNCHIMERA

SPAWNCHIMERA is a backdoor that supports command and control and can inject malicious components into native processes.[1][2][3] SPAWNCHIMERA It incorporates capabilities from multiple tools within the SPAWN malware family, including SPAWNANT, SPAWNMOLE, and SPAWNSNAIL.[4][2][3] SPAWNCHIMERA was first reported in April 2024.[2] SPAWNCHIMERA has been observed in activity attributed to People's Republic of China (PRC) state-sponsored threat actors, including UNC5221..[4][5][2][6]

LinuxNetwork Devices
MalwareEnterprise

S1217: VIRTUALPITA

VIRTUALPITA is a passive backdoor with ESXi and Linux vCenter variants capable of command execution, file transfer, and starting and stopping processes. VIRTUALPITA has been in use since at least 2022 including by UNC3886 who leveraged malicious vSphere Installation Bundles (VIBs) for install on ESXi hypervisors.[1]

ESXiLinux
MalwareEnterprise

S1161: BPFDoor

BPFDoor is a Linux based passive long-term backdoor used by China-based threat actors. First seen in 2021, BPFDoor is named after its usage of Berkley Packet Filter (BPF) to execute single task instructions. BPFDoor supports multiple protocols for communicating with a C2 including TCP, UDP, and ICMP and can start local or reverse shells that bypass firewalls using iptables.[1][2]

Linux
CampaignEnterprise

C0046: ArcaneDoor

ArcaneDoor is a campaign targeting networking devices from Cisco and other vendors between July 2023 and April 2024, primarily focused on government and critical infrastructure networks. ArcaneDoor is associated with the deployment of the custom backdoors Line Runner and Line Dancer. ArcaneDoor is attributed to a group referred to as UAT4356 or STORM-1849, and is assessed to be a state-sponsored campaign.[1][2]

CampaignEnterprise

C0056: RedPenguin

The RedPenguin project was launched by Juniper in July 2024 to investigate reported malware infections of Juniper MX Series routers. RedPenguin activity was separately attributed to UNC3886 and included the deployment of multiple custom versions of the publicly-available TINYSHELL backdoor on Juniper routers.[1][2]

Relationship explorer

All related ATT&CK context

uses · MalwareS1186: Line DancerEnterpriserevoked by · TechniqueT1562.003: Impair Command History LoggingEnterprisemitigates · MitigationM1039: Environment Variable PermissionsEnterpriseuses · GroupG1041: Sea TurtleEnterpriseuses · MalwareS9015: BRICKSTORMEnterpriseuses · GroupG1048: UNC3886Enterpriseuses · ToolS0692: SILENTTRINITYEnterpriseuses · GroupG0082: APT38Enterpriseuses · CampaignC0046: ArcaneDoorEnterpriseuses · GroupG1051: Medusa GroupEnterpriseuses · MalwareS9024: SPAWNCHIMERAEnterpriseuses · MalwareS1217: VIRTUALPITAEnterpriserevoked by · TechniqueT1148: HISTCONTROLEnterprisemitigates · MitigationM1028: Operating System ConfigurationEnterpriseuses · MalwareS1161: BPFDoorEnterpriseuses · CampaignC0056: RedPenguinEnterprisedetects · Detection StrategyDET0563: Detection Strategy for Defense Impairment via Prevent Command History Logging across OS platforms.Enterprise
Mitigations

Mitigation direction

MitigationEnterprise

M1039: Environment Variable Permissions

Restrict the modification of environment variables to authorized users and processes by enforcing strict permissions and policies. This ensures the integrity of environment variables, preventing adversaries from abusing or altering them for malicious purposes. This mitigation can be implemented through the following measures:

Restrict Write Access:

- Use Case: Set file system-level permissions to restrict access to environment variable configuration files (e.g., `.bashrc`, `.bash_profile`, `.zshrc`, `systemd` service files). - Implementation: Configure `/etc/environment` or `/etc/profile` on Linux systems to only allow root or administrators to modify the file.

Secure Access Controls:

- Use Case: Limit access to environment variable settings in application deployment tools or CI/CD pipelines to authorized personnel. - Implementation: Use role-based access control (RBAC) in tools like Jenkins or GitLab to ensure only specific users can modify environment variables.

Restrict Process Scope:

- Use Case: Configure policies to ensure environment variables are only accessible to the processes they are explicitly intended for. - Implementation: Use containerized environments like Docker to isolate environment variables to specific containers and ensure they are not inherited by other processes.

Audit Environment Variable Changes:

- Use Case: Enable logging for changes to critical environment variables. - Implementation: Use `auditd` on Linux to monitor changes to files like `/etc/environment` or application-specific environment files.

MitigationEnterprise

M1028: Operating System Configuration

Operating System Configuration involves adjusting system settings and hardening the default configurations of an operating system (OS) to mitigate adversary exploitation and prevent abuse of system functionality. Proper OS configurations address security vulnerabilities, limit attack surfaces, and ensure robust defense against a wide range of techniques. This mitigation can be implemented through the following measures:

Disable Unused Features:

- Turn off SMBv1, LLMNR, and NetBIOS where not needed. - Disable remote registry and unnecessary services.

Enforce OS-level Protections:

- Enable Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), and Control Flow Guard (CFG) on Windows. - Use AppArmor or SELinux on Linux for mandatory access controls.

Secure Access Settings:

- Enable User Account Control (UAC) for Windows. - Restrict root/sudo access on Linux/macOS and enforce strong permissions using sudoers files.

File System Hardening:

- Implement least-privilege access for critical files and system directories. - Audit permissions regularly using tools like icacls (Windows) or getfacl/chmod (Linux/macOS).

Secure Remote Access:

- Restrict RDP, SSH, and VNC to authorized IPs using firewall rules. - Enable NLA for RDP and enforce strong password/lockout policies.

Harden Boot Configurations:

- Enable Secure Boot and enforce UEFI/BIOS password protection. - Use BitLocker or LUKS to encrypt boot drives.

Regular Audits:

- Periodically audit OS configurations using tools like CIS Benchmarks or SCAP tools.

*Tools for Implementation*

Windows:

- Microsoft Group Policy Objects (GPO): Centrally enforce OS security settings. - Windows Defender Exploit Guard: Built-in OS protection against exploits. - CIS-CAT Pro: Audit Windows security configurations based on CIS Benchmarks.

Linux/macOS:

- AppArmor/SELinux: Enforce mandatory access controls. - Lynis: Perform comprehensive security audits. - SCAP Security Guide: Automate configuration hardening using Security Content Automation Protocol.

Cross-Platform:

- Ansible or Chef/Puppet: Automate configuration hardening at scale. - OpenSCAP: Perform compliance and configuration checks.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
6101558ae782fcd5...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundle6101558ae782…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Google Cloud Threat Intelligence ESXi VIBs 2022

    Alexander Marvi, Jeremy Koppen, Tufail Ahmed, and Jonathan Lepore. (2022, September 29). Bad VIB(E)s Part One: Investigating Novel Malware Persistence Within ESXi Hypervisors. Retrieved March 26, 2025.

    Open source URL
  2. [2]
    Microsoft about_History prevent command history

    Microsoft. (n.d.). Retrieved April 15, 2026.

    Open source URL
  3. [3]
    Sophos PowerShell Command History Forensics

    Vikas, S. (2020, August 26). PowerShell Command History Forensics. Retrieved November 17, 2024.

    Open source URL
  4. [4]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  5. [5]
    Securing bash history

    Mathew Branwell. (2012, March 21). Securing .bash_history file. Retrieved July 8, 2017.

  6. [6]
    Hunt Sea Turtle 2024

    Hunt & Hackett Research Team. (2024, January 5). Turkish espionage campaigns in the Netherlands. Retrieved November 20, 2024.

    Open source URL
  7. [7]
    CISA BRICKSTORM UNC5221 AR25-338A February 2026

    DHS/CISA. (2026, February 11). AR25-338A: BRICKSTORM Backdoor. Retrieved April 16, 2026.

    Open source URL
  8. [8]
    Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023

    Alexander Marvi, Brad Slaybaugh, Ron Craft, and Rufus Brown. (2023, June 13). VMware ESXi Zero-Day Used by Chinese Espionage Actor to Perform Privileged Guest Operations on Compromised Hypervisors. Retrieved March 26, 2025.

    Open source URL
  9. [9]
    GitHub SILENTTRINITY Modules July 2019

    Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022.

    Open source URL
  10. [10]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  11. [11]
    CCCS ArcaneDoor 2024

    Canadian Centre for Cyber Security. (2024, April 24). Cyber Activity Impacting CISCO ASA VPNs. Retrieved January 6, 2025.

    Open source URL
  12. [12]
    CISA Medusa Group Medusa Ransomware March 2025

    Cybersecurity and Infrastructure Security Agency. (2025, March 12). AA25-071A #StopRansomware: Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  13. [13]
    CISA SPAWNCHIMERA RESURGE February 2026

    DHS/CISA. (2026, February 26). MAR-25993211-r1.v2 Ivanti Connect Secure (RESURGE): AR25-087A. Retrieved April 17, 2026.

    Open source URL
  14. [14]
    Google UNC5221 Ivanti April 2025

    John Wolfram, Michael Edie, Jacob Thompson, Matt Lin, Josh Murchie. (2025, April 3). Suspected China-Nexus Threat Actor Actively Exploiting Critical Ivanti Connect Secure Vulnerability (CVE-2025-22457). Retrieved April 13, 2026.

    Open source URL
  15. [15]
    Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024

    Matt Lin, Austin Larsen, John Wolfram, Ashley Pearson, Josh Murchie, Lukasz Lamparski, Joseph Pisano, Ryan Hall, Ron Craft, Shawn Crew, Billy Wong, Tyler McLellan. (2024, April 4). Cutting Edge, Part 4: Ivanti Connect Secure VPN Post-Exploitation Lateral Movement Case Studies. Retrieved April 16, 2026.

    Open source URL
  16. [16]
    Picus Security UNC5221 Ivanti May 2025

    Sila Ozeren Hacioglu. (2025, May 5). UNC5221’s Latest Exploit: Weaponizing CVE-2025-22457 in Ivanti Connect Secure. Retrieved April 13, 2026.

    Open source URL
  17. [17]
    Sandfly BPFDoor 2022

    The Sandfly Security Team. (2022, May 11). BPFDoor - An Evasive Linux Backdoor Technical Analysis. Retrieved September 29, 2023.

    Open source URL
  18. [18]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  19. [19]
    Juniper RedPenguin MAR 2025

    Juniper Networks, Cybersecurity R&D. (2025, March 11). The RedPenguin Malware Incident. Retrieved June 24, 2025.

    Open source URL
  20. [20]
    Google Cloud Threat Intelligence ESXi VIBs 2022

    Alexander Marvi, Jeremy Koppen, Tufail Ahmed, and Jonathan Lepore. (2022, September 29). Bad VIB(E)s Part One: Investigating Novel Malware Persistence Within ESXi Hypervisors. Retrieved March 26, 2025.

    Open source URL
  21. [21]
    Google Cloud Threat Intelligence ESXi VIBs 2022

    Alexander Marvi, Jeremy Koppen, Tufail Ahmed, and Jonathan Lepore. (2022, September 29). Bad VIB(E)s Part One: Investigating Novel Malware Persistence Within ESXi Hypervisors. Retrieved March 26, 2025.

    Open source URL
  22. [22]
    Microsoft about_History prevent command history

    Microsoft. (n.d.). Retrieved April 15, 2026.

    Open source URL
  23. [23]
    Microsoft about_History prevent command history

    Microsoft. (n.d.). Retrieved April 15, 2026.

    Open source URL
  24. [24]
    Sophos PowerShell Command History Forensics

    Vikas, S. (2020, August 26). PowerShell Command History Forensics. Retrieved November 17, 2024.

    Open source URL
  25. [25]
    Sophos PowerShell Command History Forensics

    Vikas, S. (2020, August 26). PowerShell Command History Forensics. Retrieved November 17, 2024.

    Open source URL
  26. [26]
    mitre-attackT1690
    Open source URL
  27. [27]
    mitre-attackT1690
    Open source URL
  28. [28]
    mitre-attackT1690
    Open source URL
  29. [29]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  30. [30]
    Securing bash history

    Mathew Branwell. (2012, March 21). Securing .bash_history file. Retrieved July 8, 2017.

  31. [31]
    Hunt Sea Turtle 2024

    Hunt & Hackett Research Team. (2024, January 5). Turkish espionage campaigns in the Netherlands. Retrieved November 20, 2024.

    Open source URL
  32. [32]
    CISA BRICKSTORM UNC5221 AR25-338A February 2026

    DHS/CISA. (2026, February 11). AR25-338A: BRICKSTORM Backdoor. Retrieved April 16, 2026.

    Open source URL
  33. [33]
    Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023

    Alexander Marvi, Brad Slaybaugh, Ron Craft, and Rufus Brown. (2023, June 13). VMware ESXi Zero-Day Used by Chinese Espionage Actor to Perform Privileged Guest Operations on Compromised Hypervisors. Retrieved March 26, 2025.

    Open source URL
  34. [34]
    GitHub SILENTTRINITY Modules July 2019

    Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022.

    Open source URL
  35. [35]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  36. [36]
    CCCS ArcaneDoor 2024

    Canadian Centre for Cyber Security. (2024, April 24). Cyber Activity Impacting CISCO ASA VPNs. Retrieved January 6, 2025.

    Open source URL
  37. [37]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  38. [38]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  39. [39]
    CISA Medusa Group Medusa Ransomware March 2025

    Cybersecurity and Infrastructure Security Agency. (2025, March 12). AA25-071A #StopRansomware: Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  40. [40]
    CISA SPAWNCHIMERA RESURGE February 2026

    DHS/CISA. (2026, February 26). MAR-25993211-r1.v2 Ivanti Connect Secure (RESURGE): AR25-087A. Retrieved April 17, 2026.

    Open source URL
  41. [41]
    Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024

    Matt Lin, Austin Larsen, John Wolfram, Ashley Pearson, Josh Murchie, Lukasz Lamparski, Joseph Pisano, Ryan Hall, Ron Craft, Shawn Crew, Billy Wong, Tyler McLellan. (2024, April 4). Cutting Edge, Part 4: Ivanti Connect Secure VPN Post-Exploitation Lateral Movement Case Studies. Retrieved April 16, 2026.

    Open source URL
  42. [42]
    Google UNC5221 Ivanti April 2025

    John Wolfram, Michael Edie, Jacob Thompson, Matt Lin, Josh Murchie. (2025, April 3). Suspected China-Nexus Threat Actor Actively Exploiting Critical Ivanti Connect Secure Vulnerability (CVE-2025-22457). Retrieved April 13, 2026.

    Open source URL
  43. [43]
    Picus Security UNC5221 Ivanti May 2025

    Sila Ozeren Hacioglu. (2025, May 5). UNC5221’s Latest Exploit: Weaponizing CVE-2025-22457 in Ivanti Connect Secure. Retrieved April 13, 2026.

    Open source URL
  44. [44]
    Google Cloud Threat Intelligence ESXi VIBs 2022

    Alexander Marvi, Jeremy Koppen, Tufail Ahmed, and Jonathan Lepore. (2022, September 29). Bad VIB(E)s Part One: Investigating Novel Malware Persistence Within ESXi Hypervisors. Retrieved March 26, 2025.

    Open source URL
  45. [45]
    Google Cloud Threat Intelligence ESXi VIBs 2022

    Alexander Marvi, Jeremy Koppen, Tufail Ahmed, and Jonathan Lepore. (2022, September 29). Bad VIB(E)s Part One: Investigating Novel Malware Persistence Within ESXi Hypervisors. Retrieved March 26, 2025.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use