huntrule

Windows PowerShell History File Access Attempt via ConsoleHost_history.txt

Alerts on Windows process executions whose command line references PowerShell console history files or HistorySavePath.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
Luc Génaux (SigmaHQ), DRL 1.1
Published
2025-04-03
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Cred Access

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process command lines that reference ConsoleHost_history.txt or the PowerShell option (Get-PSReadLineOption).HistorySavePath, indicating an attempt to access saved PowerShell console history. Attackers may use this history to recover sensitive plaintext entries such as passwords or to conduct reconnaissance based on prior commands. Telemetry relies on Windows process creation events and the observed command line content that includes these history file indicators.

Reporting behind it

Related detections9 linkedT1552.001 — drag to rearrange
Malicious Veeam Backup Credential Theft via psql Query of Credentials Table (via process_creation)
Malicious Marimo Notebook Credential File Access via Shell (via process_creation)
Malicious Keyhunter Worker Persistence via Systemd Service
Suspicious TruffleHog Execution Spawned by Bun Runtime via Process Creation
Malicious AWS Credential Exfiltration via Curl or Wget in Process Creation
Suspicious sqlite3 Access to gcloud Cached Access Token Database (via process_creation)
Suspicious AWS GetCallerIdentity From TruffleHog User Agent via Cloudtrail
Suspicious GitHub CLI Auth Token Extraction via Command Line
Suspicious Access to macOS Login Keychain by Slow Pisces (via process_creation)
Windows PowerShell History File Access Attempt via ConsoleHost_history.txt
Pivot detection · T1552.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.