PowerShell History Logging Disabled

nomit vyas@xoxo

•updated Jun 24, 2026•1•0•3

This rule detects attempts to disable PowerShell history logging by using 'Set-PSReadlineOption' with 'HistorySaveStyle' set to 'SaveNothing'. This technique can be used by adversaries to hinder forensic analysis and hide their command execution history.