Windows PowerShell History File Access Attempt via ConsoleHost_history.txt

Alerts on Windows process executions whose command line references PowerShell console history files or HistorySavePath.

FreeUnreviewedSigmamediumv1

windows-powershell-history-file-access-attempt-via-consolehost-history-txt-f4ff7323

title: Windows PowerShell History File Access Attempt via ConsoleHost_history.txt
id: 6d5ef6d9-2f01-4ec3-9a90-00cd6d70a150
status: experimental
description: This rule flags process command lines that reference ConsoleHost_history.txt or the PowerShell option (Get-PSReadLineOption).HistorySavePath, indicating an attempt to access saved PowerShell console history. Attackers may use this history to recover sensitive plaintext entries such as passwords or to conduct reconnaissance based on prior commands. Telemetry relies on Windows process creation events and the observed command line content that includes these history file indicators.
references:
  - https://0xdf.gitlab.io/2018/11/08/powershell-history-file.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_console_history_file_access.yml
author: Luc Génaux, Huntrule Team
date: 2025-04-03
tags:
  - attack.credential-access
  - attack.t1552.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - ConsoleHost_history.txt
      - (Get-PSReadLineOption).HistorySavePath
  condition: selection
falsepositives:
  - Legitimate access of the console history file is possible
level: medium
license: DRL-1.1
related:
  - id: f4ff7323-b5fc-4323-8b52-6b9408e15788
    type: derived

What it detects

This rule flags process command lines that reference ConsoleHost_history.txt or the PowerShell option (Get-PSReadLineOption).HistorySavePath, indicating an attempt to access saved PowerShell console history. Attackers may use this history to recover sensitive plaintext entries such as passwords or to conduct reconnaissance based on prior commands. Telemetry relies on Windows process creation events and the observed command line content that includes these history file indicators.

Known false positives

Legitimate access of the console history file is possible

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.