Potential PowerShell Console History Access Attempt

SigmaHQ Detections@sigmaHQ

•updated Sep 22, 2025•0•16

Detects attempts to access the PowerShell console history file (ConsoleHost_history.txt) or retrieve its path. This activity can indicate an adversary attempting to gather plaintext credentials or perform reconnaissance on previously executed commands.