1200KM / sigma-rule
PowerShell Console History Logs Deleted — Sigma Rule
Sigma rule ff301988-c231-4bd0-834c-ac9d73b86586. PowerShell Console History Logs Deleted — Sigma Rule. Detects the deletion of the PowerShell console History logs which may indicate an attempt to destroy forensic evidence
Rule metadata and linked tags
Author: Nasreddine Bencherchali (Nextron Systems). Source status: test; severity: medium. Source dates: 2023-02-15 / not supplied.
{
"category": "file_delete",
"product": "windows"
}Pinned original Sigma rule · Detection Rule License 1.1
Source SHA-256: 2c7e456cc445692dbe8db202389d217727f55bd3d574e8f35c61892ef5f21ae3
Detection logic
Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.
title: PowerShell Console History Logs Deleted
id: ff301988-c231-4bd0-834c-ac9d73b86586
status: test
description: Detects the deletion of the PowerShell console History logs which may indicate an attempt to destroy forensic evidence
references:
- Internal Research
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-02-15
tags:
- attack.stealth
- attack.t1070
logsource:
category: file_delete
product: windows
detection:
selection:
TargetFilename|endswith: '\PSReadLine\ConsoleHost_history.txt'
condition: selection
falsepositives:
- Unknown
level: medium
False positives
- Unknown
Source references
- Internal Research (source note; no public URL supplied)
Connected ecosystem references
Exact source-tagged techniques
Telemetry review
Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.