huntrule

Windows PowerShell Command History Disable via Remove-Module psreadline

Detects PowerShell scripts that remove psreadline with Remove-Module to suppress command history evidence.

FreeReviewedSigma · High · v2
Product
windows
Category
ps_script
Author
Ali Alwashali (SigmaHQ), DRL 1.1
Published
2022-08-21
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags PowerShell script content that removes the psreadline module, a common method used to disable or interfere with PowerShell command history. Attackers may do this to reduce user-visible traces and complicate incident response. It relies on script block text telemetry that includes the commands executed within PowerShell.

Reporting behind it

Related detections8 linkedT1070.003 — drag to rearrange
Suspicious Shell History Clearing or Disabling (via process_creation)
Suspicious COLDRIVER RunMRU History Clearing via Reg Delete (via process_creation)
Suspicious File Immutability Set via chattr for Anti-Removal on Linux
Suspicious Clearing of Linux Authentication and History Logs
Windows Registry RunMRU Key Deletion
Windows: Detect reg.exe Deletion of RunMRU Registry Key
Windows PowerShell Clears Console History via Clear-History
Cisco Network OS Log and Archive Clearing via “clear logging” Commands
Windows PowerShell Command History Disable via Remove-Module psreadline
Pivot detection · T1070.003 · 8 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.