PowerShell Clears Console History via Clear-History or PSReadline History Path Deletion (Windows)

title: PowerShell Clears Console History via Clear-History or PSReadline History Path Deletion (Windows)
id: f967fabc-48c1-4ce8-99a3-78260508d3e8
status: test
description: This rule identifies PowerShell script activity intended to clear or remove console command history, including usage of Clear-History and removal of files tied to PSReadline history storage. Attackers may use this behavior to reduce forensic visibility of commands executed during an intrusion. The detection relies on Script Block Logging content that matches history-clearing keywords and associated history file/path references.
references:
  - https://stefanos.cloud/blog/kb/how-to-clear-the-powershell-command-history/
  - https://www.shellhacks.com/clear-history-powershell/
  - https://community.sophos.com/sophos-labs/b/blog/posts/powershell-command-history-forensics
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_clearing_windows_console_history.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-11-25
modified: 2022-12-25
tags:
  - attack.stealth
  - attack.t1070
  - attack.t1070.003
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection1:
    ScriptBlockText|contains: Clear-History
  selection2a:
    ScriptBlockText|contains:
      - Remove-Item
      - rm
  selection2b:
    ScriptBlockText|contains:
      - ConsoleHost_history.txt
      - (Get-PSReadlineOption).HistorySavePath
  condition: selection1 or selection2a and selection2b
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: bde47d4b-9987-405c-94c7-b080410e8ea7
    type: derived