Threat Actors may search the command history on compromised systems for insecurely stored credentials.
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.