Shell history is the saved record of commands entered in a command-line shell such as bash, zsh, or PowerShell. It often includes timestamps, paths, usernames, scripts, and administrative commands, depending on configuration. Because it can reveal exactly what an operator typed, shell history is a valuable artifact in cyber security.
For defenders, shell history helps reconstruct attacker behavior: initial reconnaissance, privilege escalation attempts, file transfers, persistence changes, and cleanup steps may all leave command traces. On exposed servers or compromised hosts, this history can expose tradecraft and identify which systems were touched. For investigators, preserving the file before the system is altered is important. For operators and administrators, minimizing sensitive command exposure, using ephemeral sessions where appropriate, and controlling history storage can reduce leakage. In ransomware cases, shell history can reveal preparation work even when the final payload is not yet visible.