Clearing Windows Console History

Title: Clearing Windows Console History
Status: test
Description:Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.
References:
  -https://stefanos.cloud/blog/kb/how-to-clear-the-powershell-command-history/
  -https://www.shellhacks.com/clear-history-powershell/
  -https://community.sophos.com/sophos-labs/b/blog/posts/powershell-command-history-forensics
Author: Austin Songer @austinsonger
Date: 2021-11-25
modified:2022-12-25
Tags:

• -'attack.stealth'
• -'attack.t1070'
• -'attack.t1070.003'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection1:
    ScriptBlockText|contains: 'Clear-History'
  selection2a:
    ScriptBlockText|contains:
      -'Remove-Item'
      -'rm'

  selection2b:
    ScriptBlockText|contains:
      -'ConsoleHost_history.txt'
      -'(Get-PSReadlineOption).HistorySavePath'

  condition:selection1 or selection2a and selection2b
Falsepositives:
  -Unknown
Level: high