PowerShell Console History Logs Deleted
This rule detects the deletion of PowerShell console history logs, specifically the 'ConsoleHost_history.txt' file located within the 'PSReadLine' directory. Adversaries often delete these logs to remove forensic evidence of their commands and activities, making it harder for defenders to trace their actions and understand the scope of a compromise. This action is a common defense evasion technique.
Sigma
