Disable Powershell Command History

Title: Disable Powershell Command History
Status: test
Description:Detects scripts or commands that disabled the Powershell command history by removing psreadline module
References:
  -https://twitter.com/DissectMalware/status/1062879286749773824
Author: Ali Alwashali
Date: 2022-08-21
modified:None
Tags:

• -'attack.stealth'
• -'attack.t1070.003'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection:
    ScriptBlockText|contains|all:
      -'Remove-Module'
      -'psreadline'

  condition:selection
Falsepositives:
  -Legitimate script that disables the command history
Level: high