osquery-defense-kit/incident_response/shell_history.sql

-- Retrieves the command history, per user, by parsing the shell history files.
--
-- interval: 86400
-- platform: posix
-- value: Identify actions taken. Useful for compromised hosts.
-- version: 1.4.5

select * from users join shell_history using (uid);