1200KM / sigma-rule
Potential PowerShell Console History Access Attempt via History File — Sigma Rule
Sigma rule f4ff7323-b5fc-4323-8b52-6b9408e15788. Potential PowerShell Console History Access Attempt via History File — Sigma Rule. Detects potential access attempts to the PowerShell console history directly via history file (ConsoleHost_history.txt). This can give access to plaintext passwords used in PowerShell commands or used for general reconnaissance.
Rule metadata and linked tags
Author: Luc Génaux. Source status: experimental; severity: medium. Source dates: 2025-04-03 / not supplied.
{
"category": "process_creation",
"product": "windows"
}Pinned original Sigma rule · Detection Rule License 1.1
Source SHA-256: 37e30936d9e4de3099c9502626204928f697d6eaea2a00f6a8e4ee5b2907e348
Detection logic
Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.
title: Potential PowerShell Console History Access Attempt via History File
id: f4ff7323-b5fc-4323-8b52-6b9408e15788
status: experimental
description: |
Detects potential access attempts to the PowerShell console history directly via history file (ConsoleHost_history.txt).
This can give access to plaintext passwords used in PowerShell commands or used for general reconnaissance.
references:
- https://0xdf.gitlab.io/2018/11/08/powershell-history-file.html
author: Luc Génaux
date: 2025-04-03
tags:
- attack.credential-access
- attack.t1552.001
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains:
- 'ConsoleHost_history.txt'
- '(Get-PSReadLineOption).HistorySavePath'
condition: selection
falsepositives:
- Legitimate access of the console history file is possible
level: medium
False positives
- Legitimate access of the console history file is possible
Source references
Connected ecosystem references
Exact source-tagged techniques
Telemetry review
Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.