Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
53 detections
Filters
Last updated
All Time
Detection languages
27
17
3
2
2
Contributors
16
10
8
5
3
Categories
26
16
14
13
13
Platforms
26
25
4
3
1
Products / Services
18
12
12
4
3
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
IDS Classtypes
2
IDS Protocols
2
Detects keywords that could indicate clearing PowerShell history
Detects keywords that could indicate clearing PowerShell history
Detects scripts or commands that disabled the Powershell command history by removing psreadline module
This analytic detects the deletion of the ConsoleHost_history.txt file, which stores command history for PowerShell sessions. Attackers may attempt to remove this file to cover their tracks and evade detection during post-exploitation activities. This detection focuses on file deletion commands executed via PowerShell, Command Prompt, or scripting languages that specifically target ConsoleHost_history.txt, typically located at %APPDATA%\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt. Identifying such activity can help uncover potential anti-forensic behavior and suspicious administrative actions.
Detects commands that attempt to clear or tamper with the Linux command history. This technique is often used by threat actors to evade detection and execute commands without leaving a record in files like "bash_history" or "zsh_history". The rule specifically looks for various commands and patterns used to delete, truncate, or otherwise manipulate history files, as well as the specific log message "empty_bash_history" which can be generated by a provided monitoring script.
This rule detects attempts to clear logging or archive history on Cisco network devices. Adversaries may clear command history or logging to remove forensic evidence of their activities, which is a common defense evasion technique.
This rule identifies attempts to clear the PowerShell console history. Adversaries often clear command history to remove traces of their activities on a compromised system, making forensic analysis more difficult. The rule specifically looks for the 'Clear-History' cmdlet or the deletion of the 'ConsoleHost_history.txt' file, which stores PowerShell command history.
Detects keywords within PowerShell module logs that indicate an attempt to clear PowerShell history. This includes commands like 'Remove-Item' or 'del' targeting the history file path, or 'Set-PSReadlineOption' to disable history saving.
This rule detects attempts to clear PowerShell command history, which adversaries might do to remove traces of their activities. It looks for specific PowerShell commands and keywords related to deleting history files or configuring PowerShell to not save history. This includes commands like 'del', 'Remove-Item', 'rm' in conjunction with the PowerShell history path, or setting 'Set-PSReadlineOption -HistorySaveStyle SaveNothing'.
Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.
Open a handle on the drive volume via the \\.\ DOS device path specifier and perform direct access read of the first few bytes of the volume.
Page 3 of 3