Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Potential PowerShell Console History Access Attempt via History File

Detects potential access attempts to the PowerShell console history directly via history file (ConsoleHost_history.txt). This can give access to plaintext passwords used in PowerShell commands or used for general reconnaissance.

ATT&CK coverage

Credential Access

T1552Unsecured Credentials
- T1552.001Credentials In Files 61 detections cover this technique

Detection requirements

Log source product: windows
Log source category: process_creation

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.