Clear PowerShell History - PowerShell Module

Title: Clear PowerShell History - PowerShell Module
Status: test
Description:Detects keywords that could indicate clearing PowerShell history
References:
  -https://gist.github.com/hook-s3c/7363a856c3cdbadeb71085147f042c1a
Author: Ilyas Ochkov, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community
Date: 2019-10-25
modified:2022-12-02
Tags:

• -'attack.stealth'
• -'attack.t1070.003'

Logsource:

• product: windows
• category: ps_module
• definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b

Detection:
  selection_1a_payload:
    Payload|contains:
      -'del'
      -'Remove-Item'
      -'rm'

  selection_1b_payload:
    Payload|contains: '(Get-PSReadlineOption).HistorySavePath'
  selection_payload_2:
    Payload|contains|all:
      -'Set-PSReadlineOption'
      -'–HistorySaveStyle'
      -'SaveNothing'

  selection_payload_3:
    Payload|contains|all:
      -'Set-PSReadlineOption'
      -'-HistorySaveStyle'
      -'SaveNothing'

  condition:1 of selection_payload_* or all of selection_1*
Falsepositives:
  -Legitimate PowerShell scripts
Level: medium