Detectionhightest

Disable Powershell Command History

Detects scripts or commands that disabled the Powershell command history by removing psreadline module

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Ali AlwashaliCreated Sun Aug 21602f5669-6927-4688-84db-0d4b7afb2150windows

Log Source

WindowsPowerShell Script

ProductWindows← raw: windows

CategoryPowerShell Script← raw: ps_script

Definition

Requirements: Script Block Logging must be enabled

Detection Logic

detection:
    selection:
        ScriptBlockText|contains|all:
            - Remove-Module
            - psreadline
    condition: selection

False Positives

Legitimate script that disables the command history

References

MITRE ATT&CK

Tactics

Sub-techniques

Rule Metadata

Rule ID

602f5669-6927-4688-84db-0d4b7afb2150

Status

test

Level

high

Type

Detection

Created

Sun Aug 21

Author

Path

rules/windows/powershell/powershell_script/posh_ps_disable_psreadline_command_history.yml

Raw Tags

attack.defense-evasionattack.t1070.003