Detection rules › Sigma

Clear PowerShell History - PowerShell Module

Severity
medium
Author
Ilyas Ochkov, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community
Source
upstream

Detects keywords that could indicate clearing PowerShell history

MITRE ATT&CK coverage

TacticTechniques
Defense EvasionT1070.003 Indicator Removal: Clear Command History

Event coverage

ProviderEvent IDTitle
PowerShell4103Payload Context: ContextInfo User Data: UserData.

Stages and Predicates

Stage 1: 1 of selection_payload_2

Payload|contains: SaveNothing
Payload|contains: Set-PSReadlineOption
Payload|contains: '–HistorySaveStyle'

Stage 2: 1 of selection_payload_3

Payload|contains: -HistorySaveStyle
Payload|contains: SaveNothing
Payload|contains: Set-PSReadlineOption

Stage 3: all of selection_1a_payload

or:
Payload|contains: Remove-Item
Payload|contains: del
Payload|contains: rm

Stage 4: all of selection_1b_payload

Payload|contains: '(Get-PSReadlineOption).HistorySavePath'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Payloadmatch
  • (Get-PSReadlineOption).HistorySavePath
  • -HistorySaveStyle
  • Remove-Item
  • SaveNothing
  • Set-PSReadlineOption
  • del
  • rm
  • –HistorySaveStyle