Hayabusa medium test sigma

PowerShell Console History Logs Deleted

Detects the deletion of the PowerShell console History logs which may indicate an attempt to destroy forensic evidence

View Source

Detection Logic

{
  "file_delete": {
    "EventID": [
      23,
      26
    ],
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection": {
    "TargetFilename
| endswith": "\\PSReadLine\\ConsoleHost_history.txt"
  },
  "condition": "file_delete and selection"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...