In addition to clearing system logs, Threat Actors may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done.
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.