Detectionmediumtest

Clear PowerShell History - PowerShell Module

Detects keywords that could indicate clearing PowerShell history

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Ilyas Ochkov, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.communityCreated Fri Oct 25Updated Fri Dec 02f99276ad-d122-4989-a09a-d00904a5f9d2windows

Log Source

WindowsPowerShell Module

ProductWindows← raw: windows

CategoryPowerShell Module← raw: ps_module

Definition

0ad03ef1-f21b-4a79-8ce8-e6900c54b65b

Detection Logic

detection:
    selection_1a_payload:
        Payload|contains:
            - 'del'
            - 'Remove-Item'
            - 'rm'
    selection_1b_payload:
        Payload|contains: '(Get-PSReadlineOption).HistorySavePath'
    selection_payload_2:
        Payload|contains|all:
            - 'Set-PSReadlineOption'
            - '–HistorySaveStyle'  # not sure if the homoglyph –/- is intended, just checking for both
            - 'SaveNothing'
    selection_payload_3:
        Payload|contains|all:
            - 'Set-PSReadlineOption'
            - '-HistorySaveStyle'
            - 'SaveNothing'
    condition: 1 of selection_payload_* or all of selection_1*