PowerShell console history cleared

Siemphony@siemphonylowT1070.003unverified

AN0469 asks for `Clear-History` invocation or removal of the PSReadLine `ConsoleHost_history.txt` file, and script block logging is the only feed in the brief that carries both on one event, so the rule reads the text of the script block itself. Two shapes are matched: the `Clear-History` cmdlet, and any script block naming `ConsoleHost_history.txt`, which is how the `Remove-Item`, `Clear-Content` and redirect-to-null variants all surface, since the literal filename has to appear whichever verb is used. Limits worth knowing before this is deployed: EventID 4104 requires *Turn on PowerShell Script Block Logging*, which is off in a default install and in the MS and CIS baselines, so zero rows here means blind rather than quiet; `Clear-History` empties only the in-session buffer and never the PSReadLine file, so the two selections are not equivalent; the idiomatic `Remove-Item (Get-PSReadLineOption).HistorySavePath` never spells the filename and is therefore not seen; and the same file deleted from Explorer, from `cmd.exe` with `del`, or by any non-PowerShell process produces nothing on this feed — the brief's Sysmon EventID 23 and Security 4663 legs would be needed for that, and they carry different field names (`TargetFilename`, `ObjectName`) that this rule is not written in. Pre-emptively suppressing the history file with `Set-PSReadLineOption -HistorySaveStyle SaveNothing` is deliberately out of scope: that observable belongs to T1690, Prevent Command History Logging, whose own brief claims it, and a match on it under this technique's tag would mislabel the event. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0165, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

Event| where (EventID == 4104 and (ScriptBlockText contains "Clear-History" or ScriptBlockText contains "ConsoleHost_history.txt"))

Splunk · SPL

Run this as a search.

index=* (EventID="4104" AND (ScriptBlockText="*Clear-History*" OR ScriptBlockText="*ConsoleHost_history.txt*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (event.code == 4104 AND (TO_LOWER(powershell.file.script_block_text) LIKE "*clear-history*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*consolehost_history.txt*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="EventID" type="pcre2">(?i)^4104$</field>    <field name="ScriptBlockText" type="pcre2">(?i)(Clear-History|ConsoleHost_history\.txt)</field>    <description>PowerShell console history cleared</description>    <mitre>      <id>T1070.003</id>    </mitre>  </rule></group>

At a glance

Logsource: powershell / windows
Level: low
Category: defense_evasion_clear_logs
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 8883623d-a23a-4ffc-9cc9-0f59c1d63fbf

ATT&CKT1070.003

T1070.003Clear Command History

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondefense evasion clear logs

defense evasion clear logsAI draft — unreviewed

01 · What this rule detects

A PowerShell session erasing its own command history on Windows. MITRE's AN0469 — the only Windows analytic under DET0165 — asks for two observables: an invocation of Clear-History, or deletion of the PSReadLine file ConsoleHost_history.txt. The rule matches both by reading the text of the script block that ran. It deliberately does not match Set-PSReadLineOption -HistorySaveStyle SaveNothing; suppressing history before the fact belongs to T1690, Prevent Command History Logging, and a hit tagged attack.t1070.003 would mislabel it.

02 · Telemetry you need

One feed: the Windows PowerShell operational channel, logsource product: windows, service: powershell, copied verbatim from AN0469's first log source. The rule gates on EventID 4104 because 4104 is the only one of 4103/4104/4105/4106 that carries ScriptBlockText. 4104 requires the Turn on PowerShell Script Block Logging policy, which is off in a default install and in the Microsoft and CIS baselines — until you enable it this rule returns zero rows, and zero rows reads as quiet when it means blind. The brief also offers a Sysmon EventID 23 leg and a Security 4663 leg; those carry TargetFilename and ObjectName, and this rule is not written in that vocabulary.

03 · How the logic works

Two selections, AND-ed. selection_eventid pins EventID: 4104. selection_history is a single ScriptBlockText|contains list holding two values: Clear-History and ConsoleHost_history.txt. The filename value does more work than it looks — Remove-Item, Clear-Content and redirect-to-null all have to name the file, so one substring covers every verb. There is no path or user gate, because the field is free text and anything narrower would be guesswork. The condition is selection_eventid and selection_history, and all four backends render it.

04 · Common false positives

Shared administrator and jump-host profiles that call Clear-History at session end, deliberately, so credentials typed at a prompt do not sit in the buffer. Policy-deployed, such a profile fires once per session per host and is the dominant match by a wide margin — which is why the rule ships at low rather than medium. Behind it: history-management modules that name the file to trim or back it up and log their source verbatim on import; offboarding and re-imaging scripts deleting the file with the rest of a roaming profile; atomic tests and courseware demonstrating the string rather than using it.

05 · Detection maturity

tier_1: Lowest tier, and it stays there until the rule has been run against real data. It was derived from MITRE ATT&CK v19.2 prose and has never been executed against a single log line, so it has no measured true-positive rate, no measured volume, and no evidence its two strings appear in your estate at all. Enable 4104, run the selection as a hunt over a fortnight of history, count the profile hits, and only then decide whether this is an alert or a hunt query.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE names three knobs on AN0469 — HistoryFilePath, UserContext and CommandPattern. The two literal strings above are this pipeline's own population of CommandPattern; MITRE supplies the knob, not the values. HistoryFilePath is unusable here, since 4104 gives text rather than a path. Start by filtering your profile's own marker string out, then measure. Consider splitting the two values into separate selections: Clear-History flushes only the volatile in-session buffer and destroys nothing durable, while removal of ConsoleHost_history.txt is the arm that matches real cleanup — merged, the meaningful half triages at the cosmetic half's priority. Know the evasion, too: both selectors are literal substrings, so Remove-Item (Get-PSReadLineOption).HistorySavePath — the documented idiom — never spells the filename and is invisible, as is & (gcm Cle*r-History). Closing that needs the Sysmon 23 leg as a companion rule.

Declared by the author

Shared administrator and jump-host PowerShell profiles that call Clear-History at the end of a session deliberately, so that credentials typed at an interactive prompt are not left in the in-session buffer. Where such a profile is deployed by policy it runs on every session on every host, which makes it the dominant match by a wide margin until the profile path is excluded, and it is what sets the level.
History-management and shell-customisation script modules and profile snippets that reference the PSReadLine history file by its literal name in order to trim, deduplicate, back up or grep it; importing the module or dot-sourcing the profile logs that source verbatim under 4104 without anything being cleared.
Workstation cleanup, re-imaging and offboarding scripts — debloat scripts, Sysprep and profile-hygiene tasks — that delete ConsoleHost_history.txt along with the rest of a departing user's roaming profile.
Courseware, atomic-test harnesses and detection-engineering validation runs, where the string appears in a script block that is being demonstrated or self-tested rather than used to hide an intrusion.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1070.003, evaluated against their — events.

Share this rule

/u/siemphony/8883623d-a23a-4ffc-9cc9-0f59c1d63fbf

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

PowerShell console history cleared

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it