Detectionmediumexperimental

Potential PowerShell Console History Access Attempt via History File

Detects potential access attempts to the PowerShell console history directly via history file (ConsoleHost_history.txt). This can give access to plaintext passwords used in PowerShell commands or used for general reconnaissance.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Luc GénauxCreated Thu Apr 03f4ff7323-b5fc-4323-8b52-6b9408e15788windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        CommandLine|contains:
            - 'ConsoleHost_history.txt'
            - '(Get-PSReadLineOption).HistorySavePath'
    condition: selection

False Positives

Legitimate access of the console history file is possible

References

Resolving title…

0xdf.gitlab.io

MITRE ATT&CK

Tactics

TA0006 · Credential Access

Sub-techniques

T1552.001 · Credentials In Files

Rule Metadata

Rule ID