huntrule

Windows PowerShell History File Access Attempt via ConsoleHost_history.txt

Alerts on Windows process executions whose command line references PowerShell console history files or HistorySavePath.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
Luc Génaux (SigmaHQ), DRL 1.1
Published
2025-04-03
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Cred Access

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process command lines that reference ConsoleHost_history.txt or the PowerShell option (Get-PSReadLineOption).HistorySavePath, indicating an attempt to access saved PowerShell console history. Attackers may use this history to recover sensitive plaintext entries such as passwords or to conduct reconnaissance based on prior commands. Telemetry relies on Windows process creation events and the observed command line content that includes these history file indicators.

Reporting behind it

Related detections9 linkedT1552.001 — drag to rearrange
Suspicious UAT-10608 Hidden Credential Harvesting Script Execution via nohup
Suspicious Access to Cloud and Database Credential Files via Process
Suspicious Credential Exfiltration to webhook.site (via dns_query)
Suspicious Shai-Hulud Worm Stager Execution from Temp (via process_creation)
Suspicious prt-scan Campaign Credential Harvesting via proc environ Scan (via process_creation)
Possible Stolen AWS Credential Validation via STS GetCallerIdentity
Suspicious Double Base64 Decoded Payload Piped to Shell in CI (reviewdog Supply Chain)
Malicious Winlogon Automatic Logon Persistence via Registry AutoAdminLogon (via process_creation)
Suspicious RegAsm MSBuild or AutoIt Accessing Browser Credential Stores
Windows PowerShell History File Access Attempt via ConsoleHost_history.txt
Pivot detection · T1552.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.