Bash History

The subject uses applications, binaries, scripts, services, or administrative utilities already trusted or commonly present within the organizational environment to support or conceal an infringement without introducing new software.

Trusted tool misuse may involve operating system utilities, command and scripting environments, archive tools, managed browsers, synchronization clients, productivity applications, remote management components, or administrative consoles. Because these capabilities are routinely used for legitimate purposes, the subject’s activity may avoid software installation alerts, application control restrictions, and indicators associated with unfamiliar executables.

The anti-forensic significance arises where the subject deliberately selects a trusted capability to reduce detection, obscure intent, or make unauthorized activity appear consistent with normal operational use. Investigators should assess the subject’s role, command-line activity, file access, timing, tool combinations, and surrounding investigative indicators. The execution of a trusted tool should not be treated as inherently suspicious.

Example Behaviors

• Using a signed operating-system binary to execute unauthorized code while avoiding controls focused on unknown executables.
• Using PowerShell, Windows Command Shell, Terminal, or a Unix shell to collect, copy, encode, alter, or remove information.
• Using a built-in archive utility to stage sensitive files without installing external compression software.
• Using an approved browser, synchronization client, collaboration platform, or cloud service to transfer information through activity that resembles routine business use.
• Using native screenshot, clipboard, print, preview, export, or file-management functions to collect or alter information without specialist tooling.
• Using a trusted administrative utility or indirect execution pathway to perform unauthorized activity while reducing distinct control violations.
• Using scheduled tasks, launch agents, login items, shortcuts, or existing automation features to repeat activity without introducing new software.

The subject gathers technical information about an organizational system to understand its operating environment and to assess how it may support subsequent activities. Information collected may include the system name, operating system, version, architecture, hardware configuration, firmware or BIOS details, patch level, installed hotfixes, and other characteristics that identify the system’s capabilities or technical state.

System profiling is preparatory where the information allows the subject to select compatible tools, identify potential weaknesses, assess the suitability or value of the system, or plan subsequent access, privilege elevation, persistence, security control circumvention, or infringement.

A subject may rename a file to obscure the content of the file or change the file extension to hide the file type. This can aid in avoiding suspicion and bypassing certain security filers and endpoint monitoring tools. For example, renaming a sensitive document from FinancialReport.docx to Recipes.txt before copying it to a USB mass storage device.

The subject downloads files through remote session tools or file transfer mechanisms such as RDP drive mapping, SCP, SFTP, or remote desktop clipboard/file transfer features.