Skip to content
LinuxExecutionCritical

Bash Shell History

Per-user record of every interactive shell command executed by Bash, written to ~/.bash_history on logout (or in real time when HISTTIMEFORMAT and PROMPT_COMMAND are configured).

artifact_type: linux_bash_history

Where to find it

Default filesystem paths and registry locations. Collect these with your preferred live-response or disk-image tooling.

  • $~/.bash_history
  • $/root/.bash_history
  • $/home/*/.bash_history
  • $~/.zsh_history

Forensic significance

Common scenarios in which this artifact becomes decisive evidence.

  • Reconstructing attacker post-exploitation activity on a Linux host
  • Insider threat — proving a sysadmin ran destructive commands
  • Identifying credentials accidentally typed inline (e.g., curl -u user:pass)
  • Linking lateral movement via ssh/scp commands across hosts

MITRE ATT&CK mapping

Techniques this artifact can help detect or substantiate. Click a technique to view the official MITRE entry.

T1059.004T1552.003

Tools that parse it

unJaena AI and other DFIR tools commonly used to extract evidence from this artifact.

unJaena AI
Plaso (log2timeline)
Sleuth Kit
grep

Related artifacts

Linux

Linux Auth Log

Authentication and authorization events emitted by PAM-aware services — sshd logins, sudo invocations, su attempts, screen unlocks, and polkit decisions. The first place to look when scoping a Linux compromise.

Linux

Linux Syslog

Plain-text system event log written by rsyslog or syslog-ng, recording kernel messages, daemon output, cron jobs, and (on older distros) authentication events. Standard format on Debian/Ubuntu and RHEL/CentOS systems without journald-only logging.

Linux

Linux Cron & Scheduler Artifacts

Time-based job scheduler configuration (system and per-user crontabs, drop-in directories) plus the execution log written by cron/anacron. Key artifact for persistence detection on Linux servers.

Windows

Amcache.hve

Compatibility database introduced in Windows 8 that records every PE file executed on the system, including SHA-1 hash, full path, publisher, and first-seen timestamp.

References & further reading

Stop parsing artifacts by hand

unJaena AI ingests disk images, live-response output, and mobile backups, then automatically correlates every artifact on this page — and 200+ more — into an investigator-ready timeline.

Try unJaena AI →