Windows PowerShell Command History Disable via Remove-Module psreadline
Detects PowerShell scripts that remove psreadline with Remove-Module to suppress command history evidence.
FreeReviewedSigma · High · v2
- Product
- windows
- Category
- ps_script
- Author
- Ali Alwashali (SigmaHQ), DRL 1.1
- Published
- 2022-08-21
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell script content that removes the psreadline module, a common method used to disable or interfere with PowerShell command history. Attackers may do this to reduce user-visible traces and complicate incident response. It relies on script block text telemetry that includes the commands executed within PowerShell.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-powershell-script-removing-psreadline-via-remove-module-to-disable-comma-602f5669
title: Windows PowerShell Command History Disable via Remove-Module psreadline
id: 6cea1a5e-48c9-43a5-80b7-e2fb2ff40218
status: test
description: This rule flags PowerShell script content that removes the psreadline module, a common method used to disable or interfere with PowerShell command history. Attackers may do this to reduce user-visible traces and complicate incident response. It relies on script block text telemetry that includes the commands executed within PowerShell.
references:
- https://twitter.com/DissectMalware/status/1062879286749773824
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_disable_psreadline_command_history.yml
author: Ali Alwashali, Huntrule Team
date: 2022-08-21
tags:
- attack.stealth
- attack.t1070.003
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection:
ScriptBlockText|contains|all:
- Remove-Module
- psreadline
condition: selection
falsepositives:
- Legitimate script that disables the command history
level: high
license: DRL-1.1
related:
- id: 602f5669-6927-4688-84db-0d4b7afb2150
type: derived