LoFP / legitimate script that disables the command history

Techniques

• t1070
• t1070.003

Sample rules

Disable Powershell Command History

• source: sigma
• technicques:
  • t1070
  • t1070.003

Description

Detects scripts or commands that disabled the Powershell command history by removing psreadline module

Detection logic

condition: selection
selection:
  ScriptBlockText|contains|all:
  - Remove-Module
  - psreadline