Clear PowerShell History - PowerShell

Title: Clear PowerShell History - PowerShell
Status: test
Description:Detects keywords that could indicate clearing PowerShell history
References:
  -https://gist.github.com/hook-s3c/7363a856c3cdbadeb71085147f042c1a
Author: Ilyas Ochkov, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community
Date: 2022-01-25
modified:2022-12-02
Tags:

• -'attack.stealth'
• -'attack.t1070.003'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection1a:
    ScriptBlockText|contains:
      -'del'
      -'Remove-Item'
      -'rm'

  selection1b:
    ScriptBlockText|contains: '(Get-PSReadlineOption).HistorySavePath'
  selection_2:
    ScriptBlockText|contains|all:
      -'Set-PSReadlineOption'
      -'–HistorySaveStyle'
      -'SaveNothing'

  selection_3:
    ScriptBlockText|contains|all:
      -'Set-PSReadlineOption'
      -'-HistorySaveStyle'
      -'SaveNothing'

  condition:1 of selection_* or all of selection1*
Falsepositives:
  -Legitimate PowerShell scripts
Level: medium