PowerShell clears command history via Clear-History or ConsoleHost_history.txt deletion

Emiliano Mema@Nosalva

•updated Jul 17, 2026•6•0•11

Detects attempts by a user or attacker to clear PowerShell session command history or delete the ConsoleHost_history.txt file, which stores past PowerShell commands, often used as part of anti-forensics or indicator removal during an intrusion.