Windows PowerShell Clears Console History via Clear-History
Flags PowerShell attempts to clear or delete console/PSReadline command history to hinder command forensics.
- Product
- windows
- Category
- ps_script
- Author
- Austin Songer @austinsonger (SigmaHQ), DRL 1.1
- Published
- 2021-11-25
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell script activity that attempts to clear console or command history, including commands containing Clear-History and related filesystem or history path operations. Attackers may use this to reduce forensic visibility by removing traces of interactive commands from the affected host. The detection relies on Script Block Logging telemetry and matches specific keywords and filename/path indicators within the captured script text.
Reporting behind it
- stefanos.cloudhttps://stefanos.cloud/blog/kb/how-to-clear-the-powershell-command-history/
- shellhacks.comhttps://www.shellhacks.com/clear-history-powershell/
- community.sophos.comhttps://community.sophos.com/sophos-labs/b/blog/posts/powershell-command-history-forensics
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_clearing_windows_console_history.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows PowerShell Clears Console History via Clear-History
id: f967fabc-48c1-4ce8-99a3-78260508d3e8
status: test
description: This rule flags PowerShell script activity that attempts to clear console or command history, including commands containing Clear-History and related filesystem or history path operations. Attackers may use this to reduce forensic visibility by removing traces of interactive commands from the affected host. The detection relies on Script Block Logging telemetry and matches specific keywords and filename/path indicators within the captured script text.
references:
- https://stefanos.cloud/blog/kb/how-to-clear-the-powershell-command-history/
- https://www.shellhacks.com/clear-history-powershell/
- https://community.sophos.com/sophos-labs/b/blog/posts/powershell-command-history-forensics
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_clearing_windows_console_history.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-11-25
modified: 2022-12-25
tags:
- attack.stealth
- attack.t1070
- attack.t1070.003
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection1:
ScriptBlockText|contains: Clear-History
selection2a:
ScriptBlockText|contains:
- Remove-Item
- rm
selection2b:
ScriptBlockText|contains:
- ConsoleHost_history.txt
- (Get-PSReadlineOption).HistorySavePath
condition: selection1 or selection2a and selection2b
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: bde47d4b-9987-405c-94c7-b080410e8ea7
type: derived