Not just that, but a strong defense would also want to show evidence that the user actually ran those commands, for example, by providing shell history files.