Linux Shell History Access Via Command Line Utility — Detection Rule
The following analytic detects attempts to read shell history files (bash, zsh, fish, etc.). A history file is a log file that records all the commands executed in a shell on a Linux or Unix-based operating system. A malicious actor who gains access to a user's shell history file can potentially obtain sensitive information and use it to compromise the user's system and data.