Detection of Windows Console History Clearing

Adversaries frequently employ anti-forensic techniques to hinder post-incident investigations by erasing evidence of their presence on a compromised host. One common objective is the removal of the PowerShell command history, which logs executed commands and script interactions. By deleting the 'ConsoleHost_history.txt' file or executing the 'Clear-History' cmdlet, attackers aim to prevent defenders from reconstructing the timeline of their actions, such as C2 communication, lateral movement, or data staging. This activity is a classic indicator of an attacker attempting to cover their tracks before disconnecting from the environment. Defenders should monitor for these specific command patterns in PowerShell Script Block logs to identify potential attempts to destroy forensic evidence.

Impact

Successful execution of console history clearing significantly degrades the ability of incident response teams to perform root cause analysis, identify the scope of the compromise, and recover sensitive information about the attacker's TTPs within the environment.

Recommendation

• Enable PowerShell Script Block Logging (Event ID 4104) to capture the full command content of executed scripts.
• Deploy the provided Sigma rule to your SIEM and alert on instances of manual history deletion or clearing command patterns.
• Baseline administrative scripts that might perform log maintenance to reduce false positives.