PowerShell History Logging Disabled

nomit vyas@xoxo

•updated Jun 24, 2026•5•0•7

This rule detects attempts to disable PowerShell command history logging by using 'Set-PSReadlineOption' with 'HistorySaveStyle SaveNothing'. Adversaries often disable command history to evade detection and hinder forensic analysis.