Clear Command History
Subtechnique · ATTACK:enterprise:T1070.003
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1070.003",
"title": "Clear Command History",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1070/003",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--3aef9463-9a7a-43ba-8957-a867e07c1e6a",
"external_id": "T1070.003",
"domain": "enterprise",
"created": "2020-01-31T12:32:08.228Z",
"modified": "2026-05-12T15:12:00.627Z",
"version": "2.0",
"aliases": [
],
"tactics": [
"stealth"
],
"source_references": [
{
"source_name": "Broadcom ESXi Shell Audit",
"url": "https://knowledge.broadcom.com/external/article/321910/auditing-esxi-shell-logins-and-commands.html"
},
{
"source_name": "Sophos PowerShell command audit",
"url": "https://community.sophos.com/products/intercept/early-access-program/f/live-discover-response-queries/121529/live-discover---powershell-command-audit"
},
{
"source_name": "Microsoft PowerShell Command History",
"url": "https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_history?view=powershell-7"
},
{
"source_name": "US-CERT-TA18-106A",
"url": "https://www.us-cert.gov/ncas/alerts/TA18-106A"
},
{
"source_name": "Sophos PowerShell Command History Forensics",
"url": "https://community.sophos.com/sophos-labs/b/blog/posts/powershell-command-history-forensics"
}
]
}Explicit source assertions (18)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1070.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--061d7039-8463-46bc-9f33-ac8153c5cf22
MSTI_GentelmenRansomware_May2026ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1070.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--17257faf-d3a8-4959-9743-aa118902106c
Crowdstrike HuntReport 2022ATTACK:enterprise:S1203 → uses → ATTACK:enterprise:T1070.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2200e547-9af6-4681-b8d3-b1cc3f2ef178
Lumen J-Magic JAN 2025ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1070.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--355060ad-0dfe-441f-ac72-d0b722e23c33
MIcrosoft Mastra npm Compromise JUN 2026ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1070.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--49f16587-6e49-470a-99eb-33bebc68b84a
CISA Medusa Group Medusa Ransomware March 2025ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1070.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--52068869-8ef9-4c84-913c-0c171ba9c30f
Cisco Talos Intelligence Group · Trend Micro TeamTNTATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1070.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6c83c2c9-9042-4c6a-adac-788da36fc18d
CISA_AA25-239ASaltTyphoon_Sept2025ATTACK:enterprise:S0641 → uses → ATTACK:enterprise:T1070.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--738e9055-48af-4295-a2f5-4f7e135d1fb2
ESET Kobalos Feb 2021ATTACK:enterprise:M1029 → mitigates → ATTACK:enterprise:T1070.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--75116ba9-f247-4c5b-b966-007bb61517e5
ATTACK:enterprise:S0601 → uses → ATTACK:enterprise:T1070.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9bfac7bf-f5a7-4e43-99c6-fb1a86c0dbe3
Unit 42 Hildegard MalwareATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1070.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9e7fc18e-06a3-437f-8e3b-18f5378c9d44
ATTACK:enterprise:T1070.003 → subtechnique-of → ATTACK:enterprise:T1070
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a31e4c9c-c69d-445e-a669-0b0f6bdaff3e
ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:T1070.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a68fb27c-1aaf-474f-b97c-aff986eb5bbe
Securelist APT10 March 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1070.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b5cd5028-8d4c-4564-921e-be3a34a5212d
DFIR Report APT35 ProxyShell March 2022ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1070.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d39e7197-a9b3-4915-8cf0-98bbbd885cd5
Kaspersky ThreatNeedle Feb 2021ATTACK:enterprise:M1039 → mitigates → ATTACK:enterprise:T1070.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dcc531dd-6136-44ac-963b-3ebab0028d96
Securing bash historyATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1070.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e062ec0b-3be4-42c6-8dba-7a8a8270bbd9
Mandiant Pulse Secure Update May 2021ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1070.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f8838a1f-3a62-40cc-98dd-55943091fcef
FireEye APT41 Aug 2019