Disable PowerShell Command History by Removing PSReadLine Module
Detects PowerShell commands or scripts that attempt to disable the command history by removing the 'psreadline' module. This action is often performed by adversaries to evade detection and hinder forensic analysis by preventing their commands from being logged.
Sigma
