PowerShell history saving disabled via Set-PSReadLineOption

Siemphony@siemphonylowT1690unverified

AN1557 names `Set-PSReadLineOption` with `SaveNothing` or an altered `HistorySavePath` as the observable, and PowerShell script block logging is the one feed in the brief that can carry the cmdlet's arguments verbatim. Script block logging is off by default and requires the "Turn on PowerShell Script Block Logging" Group Policy (or the equivalent `HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging` registry key) enabled before EventID 4104 exists at all; without it this rule is blind, not quiet. This rule matches the cmdlet name together with either the `SaveNothing` save-style value or a `HistorySavePath` argument pointed at a null destination (`$null`, `NUL`, or `/dev/null`, the forms available under Windows PowerShell and PowerShell 7). It is deliberately narrower than matching `HistorySavePath` alone, since that argument also appears in benign scripts that read or display the current path without redirecting it anywhere. AN1555 (Linux) and AN1556 (macOS) are not authored under this technique. AN1555's own log source is `auditd:SYSCALL::execve` matching `unset`/`export` of `HISTFILE`/`HISTCONTROL` — but `unset` and `export` are bash builtins with no external binary of that name, so they never reach `execve()` and this selector could never fire, the same class of dead selector AUTHORING.md documents for Java/Python wrappers on this same log source. AN1556's macOS unifiedlog leg gives no field or message pattern at all, only the prose "Set or unset HIST* variables in shell environment." T1070.003's published rule for this corpus explicitly declines `Set-PSReadLineOption -HistorySaveStyle SaveNothing` as out of scope for clearing console history and reserves it for this technique — this rule is that reservation being claimed. It does not see history suppressed through `$env:PSReadLineHistorySaveStyle` set before the module loads, through a compiled or C#-hosted PowerShell runspace with no script block to log, or through direct deletion/truncation of the underlying history file, which is T1070.003's ground, not this one's. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0563, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

Event| where ((EventID == 4104 and ScriptBlockText contains "Set-PSReadLineOption") and (ScriptBlockText contains "SaveNothing" or (ScriptBlockText contains "HistorySavePath $null" or ScriptBlockText contains "HistorySavePath NUL" or ScriptBlockText contains "HistorySavePath /dev/null")))

Splunk · SPL

Run this as a search.

index=* ((EventID="4104" AND ScriptBlockText="*Set-PSReadLineOption*") AND (ScriptBlockText="*SaveNothing*" OR (ScriptBlockText="*HistorySavePath $null*" OR ScriptBlockText="*HistorySavePath NUL*" OR ScriptBlockText="*HistorySavePath /dev/null*")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((event.code == 4104 AND TO_LOWER(powershell.file.script_block_text) LIKE "*set-psreadlineoption*") AND (TO_LOWER(powershell.file.script_block_text) LIKE "*savenothing*" OR (TO_LOWER(powershell.file.script_block_text) LIKE "*historysavepath $null*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*historysavepath nul*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*historysavepath /dev/null*")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="EventID" type="pcre2">(?i)^4104$</field>    <field name="ScriptBlockText" type="pcre2">(?i)Set-PSReadLineOption</field>    <field name="ScriptBlockText" type="pcre2">(?i)(SaveNothing|(HistorySavePath \$null|HistorySavePath NUL|HistorySavePath /dev/null))</field>    <description>PowerShell history saving disabled via Set-PSReadLineOption</description>    <mitre>      <id>T1690</id>    </mitre>  </rule></group>

At a glance

Logsource: powershell / windows
Level: low
Category: suspicious_powershell
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 81636d9f-bb72-4455-b584-85c66c4b1305

ATT&CKT1690

T1690Prevent Command History Logging

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonsuspicious powershell

suspicious powershellAI draft — unreviewed

01 · What this rule detects

Set-PSReadLineOption invoked with SaveNothing or a HistorySavePath redirected to a null destination — an operator disabling PowerShell's on-disk command history, typically to keep sensitive commands out of the transcript file PSReadLine otherwise writes.

02 · Telemetry you need

PowerShell Script Block Logging (EventID 4104) — the same prerequisite as T1679: off by default, requiring the "Turn on PowerShell Script Block Logging" GPO or the HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging registry key first. A reviewer flagged this exact gap: without the policy the rule sees nothing, and that reads as "nobody is disabling history" rather than "this rule cannot see anything."

03 · How the logic works

Three selections. selection_event pins EventID 4104. selection_cmdlet requires ScriptBlockText to contain Set-PSReadLineOption. Then either selection_savenothing (SaveNothing present) or selection_nullpath (HistorySavePath followed by $null, NUL, or /dev/null — the null-destination forms available under Windows PowerShell and PowerShell 7) must also match. Matching HistorySavePath alone was deliberately rejected: that argument also appears in benign scripts that merely read or display the current path without redirecting it. Two adjacent techniques shaped the scope — this rule is explicitly the reservation T1070.003's published rule in this corpus carved out for -HistorySaveStyle SaveNothing, which that rule declined as out of scope for clearing console history. AN1555 (Linux, auditd) and AN1556 (macOS) are not authored: AN1555's own selector matches shell builtins (unset/export) that never reach execve() and so could never fire on that logsource, and AN1556 gives no field or message pattern at all, only prose.

04 · Common false positives

Security-hardening baselines for shared jump hosts and PAM bastions legitimately set SaveNothing at profile load specifically so credentials typed during a privileged session don't persist to a shared history file — this produces a script block identical to the malicious case and is the rule's most likely dominant match. Self-hosted CI/CD Windows runners (Azure DevOps, GitHub Actions) that disable history at session start so pipeline secrets aren't written to disk on a reused runner are a second recurring source. Atomic-test validation runs round out the list.

05 · Detection maturity

tier_1: Unverified, lowest DeBMM tier — never executed against a log line. The bastion/CI false-positive volume, and whether the null-path forms cover real PowerShell 7 usage in your environment, both need verification against real data before this scaffold can be trusted.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

level: low already reflects that the top false positive is a legitimate, intentional security control rather than incidental noise — treat a match as context to correlate (is this host a known bastion or CI runner?) rather than an alert on its own. Building an allowlist of hosts where SaveNothing is an approved baseline is the highest-value tuning step before this runs in production.

Declared by the author

Security-hardening baselines for shared jump hosts and PAM bastions that deliberately set SaveNothing at profile load to stop credentials typed during a privileged session from persisting into a shared history file — a legitimate control that produces the identical script block.
Self-hosted CI/CD runner initialization scripts (Azure DevOps, GitHub Actions Windows runners) that disable PSReadLine history at session start so secrets echoed during a pipeline run are never written to disk on a reused runner.
Detection-engineering and atomic-test validation runs that execute this exact cmdlet and argument to demonstrate or self-test the analytic rather than to conceal anything.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1690, evaluated against their — events.

Share this rule

/u/siemphony/81636d9f-bb72-4455-b584-85c66c4b1305

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

1 thread

@tomas-eriksen
21 Aug 2026
"Blind, not quiet" is the whole story on this one. We shipped it, saw zero hits for two months, felt good about ourselves, and then found script block logging was enabled on about 300 of 4,000 hosts. I would go further than the description does: a rule with a hard telemetry prerequisite should not be allowed to look healthy until someone has proved the channel exists on the hosts it claims to cover.
- @nadia-brandt
  21 Aug 2026
  We solved that with a canary: one host per OU runs the cmdlet on a schedule, and the rule is expected to fire there. If the canary goes quiet, we have lost the telemetry rather than the adversary having gone away. Cheap to build and it has caught two GPO regressions that nothing else noticed.

PowerShell history saving disabled via Set-PSReadLineOption

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it

1 thread