PowerShell Console History Logs Deleted
Detects the deletion of the PowerShell console History logs which may indicate an attempt to destroy forensic evidence
Sigma rule (View on GitHub)
1title: PowerShell Console History Logs Deleted
2id: ff301988-c231-4bd0-834c-ac9d73b86586
3status: test
4description: Detects the deletion of the PowerShell console History logs which may indicate an attempt to destroy forensic evidence
5references:
6 - Internal Research
7author: Nasreddine Bencherchali (Nextron Systems)
8date: 2023-02-15
9tags:
10 - attack.defense-evasion
11 - attack.t1070
12logsource:
13 category: file_delete
14 product: windows
15detection:
16 selection:
17 TargetFilename|endswith: '\PSReadLine\ConsoleHost_history.txt'
18 condition: selection
19falsepositives:
20 - Unknown
21level: medium
References
Related rules
- Clearing Windows Console History
- DLL Load By System Process From Suspicious Locations
- Disable of ETW Trace - Powershell
- ETW Trace Evasion Activity
- EventLog EVTX File Deleted