Windows PowerShell script removing psreadline via Remove-Module to disable command history

Detects PowerShell scripts that remove psreadline with Remove-Module to suppress command history evidence.

FreeUnreviewedSigmahighv1

windows-powershell-script-removing-psreadline-via-remove-module-to-disable-comma-602f5669

title: Windows PowerShell script removing psreadline via Remove-Module to disable command history
id: 6cea1a5e-48c9-43a5-80b7-e2fb2ff40218
status: test
description: This rule flags PowerShell script content that disables command history by removing the psreadline module using Remove-Module. Attackers may do this to reduce forensic visibility of interactive commands and script activity on the host. It relies on telemetry that captures PowerShell Script Block text, specifically matching for both the Remove-Module invocation and the psreadline module name.
references:
  - https://twitter.com/DissectMalware/status/1062879286749773824
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_disable_psreadline_command_history.yml
author: Ali Alwashali, Huntrule Team
date: 2022-08-21
tags:
  - attack.stealth
  - attack.t1070.003
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - Remove-Module
      - psreadline
  condition: selection
falsepositives:
  - Legitimate script that disables the command history
level: high
license: DRL-1.1
related:
  - id: 602f5669-6927-4688-84db-0d4b7afb2150
    type: derived

What it detects

This rule flags PowerShell script content that disables command history by removing the psreadline module using Remove-Module. Attackers may do this to reduce forensic visibility of interactive commands and script activity on the host. It relies on telemetry that captures PowerShell Script Block text, specifically matching for both the Remove-Module invocation and the psreadline module name.

Known false positives

Legitimate script that disables the command history

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.