Elastic Defend high stable eql

Suspicious PowerShell Console History Deletion

Identifies when a process attempts to delete PowerShell Console History. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.

View Source

Detection Logic

sequence by process.entity_id with maxspan=5m
[process where event.action == "start" and
 (
  process.name in~ ("powershell.exe", "rundll32.exe", "regsvr32.exe", "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe",
                  "winword.exe", "excel.exe") or
  process.executable : ("?:\\Users\\*", "?:\\Windows\\Temp\\*", "?:\\ProgramData\\*", "?:\\Windows\\Microsoft.NEt\\*") or
  (process.code_signature.trusted == false or process.code_signature.exists == false)
 ) and
 not user.id in ("S-1-5-18", "S-1-5-19")
 ]
[file where event.action == "deletion" and file.name : "ConsoleHost_history.txt"]

Field Validations

Loading…

Comments (0)

Loading comments...