Question about activity in terminal

[9138988]

Hey guys and gals, so on my M1 Air a few months ago I inputted these commands following:

sudo diskutil apfs listUsers /
sudo fdesetup list —extended
sysadminctl —h

I was frustrated about this issue I was facing regarding my
Mac missing the reset snd erase all content and settings option, and there was one article that listed these commands inorder to trouble shoot it. Turns out I had the button and I just didn’t see it, it was late at night and I entered these commands randomly even though they werent needed nor do I have any idea how they effected my system. This was me just being an idiot.

anyways, as a result of this fast forward a few months, i went into terminal and put in history just to record n document what I actually ran through terminal. these three results were listed, and oddly,

I closed terminal and reopened it again and ran history only for it to show these three commands

1 sudo diskutil apfs listUsers /
2 sudo fdesetup list -extended
3 sysadminctl -h
4 stop
5 history
6 history
7 sysadminctl -h
8 history

Whats concerning here is line 7 of the terminal history. Im wondering why it showed this command again as I did not enter it?

It also has a space or like an indent mark.

Basically to sum up my question, this command apparently run itself in between the intervals where I checked history once and again within 30 minutes. Theres also an indent mark infront of it unlike the time where I ran it legitimately.

Is this a sign of some sort of malware or did I somehow hit some hotkey to run the command again?

And if so what is that hot key?

I am 99.99% sure I did not type in this command again with a space for it to execute as I was just checking the history again and it recorded itself showing on the same day.

Essentially
I checked the terminal history at 8 PM and that was the 6th line of history

I checked again at 9 PM just to see something and that was the 7th line of history

So for some reason it took up the number 7 spot even though I do not recall typing this in. Does anyone have any ideas?

Thanks. And sorry for my ignorance and me tinking with things I shouldn’t be in the first place.

 

[bogdanw]

Where did you find those commands?
sysadminctl -h just displays the help for the command.
"Use sysadminctl -h for additional usage instructions."
https://support.apple.com/guide/deployment/use-secure-and-bootstrap-tokens-dep24dbdcf9e/web

 

[kschendel]

It's probably some weird zsh history quirk. I wouldn't worry about it. It's almost certain that the second sysadminctl command wasn't actually issued.

 

[9138988]

Where did you find those commands?
sysadminctl -h just displays the help for the command.
"Use sysadminctl -h for additional usage instructions."
https://support.apple.com/guide/deployment/use-secure-and-bootstrap-tokens-dep24dbdcf9e/web

Right, im worried about it appearing in recent terminal history, when I never had repeatedly typed it in myself, indicating that somebody else did it.
Thanks

 

[9138988]

It's probably some weird zsh history quirk. I wouldn't worry about it. It's almost certain that the second sysadminctl command wasn't actually issued.

Hi, thanks for your input, if you don’t mind me asking, what makes you so certain?
Cheers

 

[bogdanw]

Delete all Terminal history for the user with

rm -r ~/.zsh_sessions; rm ~/.zsh_history

close Terminal and after 30-40 minutes see if it happens again.

 

[kschendel]

Hi, thanks for your input, if you don’t mind me asking, what makes you so certain?
Cheers

Because there's no mechanism that could plausibly do that (i.e. magically reissue a command). History is maintained by the shell, and zsh seems to do some goofy stuff keeping history internally and then pushing it to .zsh_history at session exit. It seems a lot more likely to me that something got weird with updating history, as opposed to some mystery force issuing a command at random.