diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
index 61625766..37a7f020 100644
--- a/rules/falco_rules.yaml
+++ b/rules/falco_rules.yaml
@@ -2421,6 +2421,11 @@
   condition: >
     ((spawned_process and proc.name in (shred, rm, mv) and proc.args contains "bash_history") or 
      (open_write and fd.name contains "bash_history" and evt.arg.flags contains "O_TRUNC"))
+  output: >
+    Shell history had been deleted or renamed (user=%user.name type=%evt.type command=%proc.cmdline fd.name=%fd.name name=%evt.arg.name path=%evt.arg.path oldpath=%evt.arg.oldpath %container.info)
+  priority:
+    WARNING
+  tag: [process, mitre_defense_evation]
 
 - macro: consider_all_chmods
   condition: (always_true)