This command opens a file descriptor:

exec 77> /home/admin/somefile

However, when I check with lsof, it only shows me that it’s bash:

admin@i-0a8158ef4cb3362f5:~$ lsof somefile 

COMMAND PID  USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME

bash    811 admin   77w   REG  259,1        0 272875 somefile


admin@i-0a8158ef4cb3362f5:/proc/811$ ls -l fd
total 0
lrwx------ 1 admin admin 64 Aug 10 12:30 0 -> /dev/pts/0
lrwx------ 1 admin admin 64 Aug 10 12:30 1 -> /dev/pts/0
lrwx------ 1 admin admin 64 Aug 10 12:30 2 -> /dev/pts/0
lrwx------ 1 admin admin 64 Aug 10 12:30 255 -> /dev/pts/0
l-wx------ 1 admin admin 64 Aug 10 12:30 77 -> /home/admin/somefile

Is there a way to find out the exact command that created the file descriptor, and not just bash?

And one more thing: if someone executed the exec command and then cleared out the history, how can I possibly find out if the exec command was executed ?