PowerShell Console History Logs Deleted
Detects the deletion of the PowerShell console History logs which may indicate an attempt to destroy forensic evidence
Sigma rule (View on GitHub)
1title: PowerShell Console History Logs Deleted
2id: ff301988-c231-4bd0-834c-ac9d73b86586
3status: test
4description: Detects the deletion of the PowerShell console History logs which may indicate an attempt to destroy forensic evidence
5references:
6 - Internal Research
7author: Nasreddine Bencherchali (Nextron Systems)
8date: 2023/02/15
9tags:
10 - attack.defense_evasion
11 - attack.t1070
12logsource:
13 category: file_delete
14 product: windows
15detection:
16 selection:
17 TargetFilename|endswith: '\PSReadLine\ConsoleHost_history.txt'
18 condition: selection
19falsepositives:
20 - Unknown
21level: medium
References
Related rules
- EventLog EVTX File Deleted
- IIS WebServer Access Logs Deleted
- Tomcat WebServer Logs Deleted
- Exchange PowerShell Cmdlet History Deleted
- SES Identity Has Been Deleted