This anomaly detects attempts to read Linux shell history files (e.g., bash, zsh, fish) using common command-line utilities. It leverages endpoint telemetry (EDR) to correlate process activity with history file access. The SPL searches the Endpoint.Processes data model for processes that typically read or display files (cat, fmt, head, less, more, nano, sort, tail, uniq, vi, vim) in conjunction with shell history files (e.g., *.bash_history*, *.history*, *.sh_history*, *.zhistory*, *.zsh_history*, *fish_history*). The query aggregates by process, vendor/product, user, and related process metadata to surface who accessed which history file, from where, and with what tool, along with timing (firstTime/lastTime). Drilldown options enable per-user/per-host investigation and risk-scoped views over the prior 7 days. The rule ties detections to MITRE ATT&CK technique T1552.003 and represents a Linux post-exploitation/credential-gathering scenario, indicating potential attempts to harvest sensitive command history. It requires normalized, CIM-compliant data from an EDR-enabled Linux host (complete command lines, process GUIDs, and parent-child relationships) to function effectively. Known false positives include legitimate administration or automation workflows that read history for auditing or troubleshooting. Overall, it provides a focused signal for unusual access to shell history that merits investigation as a potential credential or data-gathering step.”