New Rule : PowerShell Console History File Access - proc_creation

[EzLucky]

Summary of the Pull Request

Add a new rule concerning access to the PowerShell console history file.

A red team has been seen using this technique with the following command cmd.exe /q /c powershell.exe "type C:\Users\*\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt" > output_file in order to try to retrieve plaintext passwords that may have been used in PowerShell commands.

Changelog

new: Potential PowerShell Console History File Access Attempt

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[EzLucky]

Rule updated @nasbench

[Copilot]

Pull Request Overview

This PR adds a new Sigma detection rule to identify potential unauthorized access to PowerShell console history files, which can contain sensitive information like plaintext passwords. The rule targets attempts to read the ConsoleHost_history.txt file or retrieve its path.

• Adds detection for PowerShell console history file access attempts
• Covers both direct file access and path retrieval methods
• Targets credential access techniques used by red teams for reconnaissance

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}