Windows Exchange PowerShell Cmdlet History Log Files Deleted
Flags deletion of Exchange PowerShell cmdlet history log files in the expected logging directory.
FreeReviewedSigma · High · v2
- Product
- windows
- Category
- file_delete
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-10-26
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule matches file deletions of Exchange PowerShell cmdlet history log files under a specific directory path. Attackers may remove these logs to reduce visibility into PowerShell activity and hinder forensic investigation. Telemetry relies on Windows file deletion events capturing the deleted target filename.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-exchange-powershell-cmdlet-history-log-files-deleted-a55349d8
title: Windows Exchange PowerShell Cmdlet History Log Files Deleted
id: e9a31e9d-0788-48de-a229-3edbea310f62
status: test
description: This rule matches file deletions of Exchange PowerShell cmdlet history log files under a specific directory path. Attackers may remove these logs to reduce visibility into PowerShell activity and hinder forensic investigation. Telemetry relies on Windows file deletion events capturing the deleted target filename.
references:
- https://m365internals.com/2022/10/07/hunting-in-on-premises-exchange-server-logs/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_delete/file_delete_win_delete_exchange_powershell_logs.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-26
modified: 2022-12-30
tags:
- attack.stealth
- attack.t1070
logsource:
category: file_delete
product: windows
detection:
selection:
TargetFilename|startswith: \Logging\CmdletInfra\LocalPowerShell\Cmdlet\
TargetFilename|contains: _Cmdlet_
condition: selection
falsepositives:
- Possible FP during log rotation
level: high
license: DRL-1.1
related:
- id: a55349d8-9588-4c5a-8e3b-1925fe2a4ffe
type: derived