ITM is an open framework - Submit your contributions now.

Insider Threat Matrix™

  • ID: AF001.003
  • Created: 14th July 2025
  • Updated: 14th July 2025
  • Platform: Linux
  • Contributor: The ITM Team

PYTHONHISTORY Environment Variable Null

A subject modifies the PYTHONHISTORY system environment variable used to designate the .python_history file location to equal /dev/null, resulting in it not being written to disk, denying access to this artifact for investigators.

 

This can be achieved on a per-session basis using the command PYTHONHISTORY=/dev/null python, or permanently by modifying a shell configuration file (such as ~/.bashrc or ~/.zshrc) to include the line export PYTHONHISTORY=/dev/null.