Clear PowerShell History - PowerShell Module

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•16

Detects keywords within PowerShell module logs that indicate an attempt to clear PowerShell history. This includes commands like 'Remove-Item' or 'del' targeting the history file path, or 'Set-PSReadlineOption' to disable history saving.