Detectionmediumtest

Clear PowerShell History - PowerShell

Detects keywords that could indicate clearing PowerShell history

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Ilyas Ochkov, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.communityCreated Tue Jan 25Updated Fri Dec 0226b692dc-1722-49b2-b496-a8258aa6371dwindows

Log Source

WindowsPowerShell Script

ProductWindows← raw: windows

CategoryPowerShell Script← raw: ps_script

Definition

Requirements: Script Block Logging must be enabled

Detection Logic

detection:
    selection1a:
        ScriptBlockText|contains:
            - 'del'
            - 'Remove-Item'
            - 'rm'
    selection1b:
        ScriptBlockText|contains: '(Get-PSReadlineOption).HistorySavePath'
    selection_2:
        ScriptBlockText|contains|all:
            - 'Set-PSReadlineOption'
            - '–HistorySaveStyle'  # not sure if the homoglyph –/- is intended, just checking for both
            - 'SaveNothing'
    selection_3:
        ScriptBlockText|contains|all:
            - 'Set-PSReadlineOption'
            - '-HistorySaveStyle'
            - 'SaveNothing'
    condition: 1 of selection_* or all of selection1*