PowerShell History File Deletion

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•1•1•14

Detects the deletion of PowerShell console history files (ConsoleHost_history.txt) within the PSReadLine folder. This activity can be indicative of an attacker attempting to remove forensic evidence of their commands, often seen in post-exploitation phases to hinder incident response and hide malicious activities.