PowerShell History Logging Disabled via SSH

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects attempts to disable PowerShell history logging via an SSH connection. It specifically looks for the strings "Set-PSReadlineOption" and "HistorySaveStyle" within TCP traffic destined for port 22 (SSH). This activity is indicative of an attacker trying to cover their tracks by preventing their PowerShell commands from being recorded.