History Logging Disabled via PSReadLine or Shell HISTFILE Unset

Arnold Chan@slaz

•updated Sep 8, 2026•0•0•1

This rule detects attempts by users to disable or clear command line history logs for shell environments, including PowerShell (e.g., modifying PSReadLine history) and Unix-like shells (e.g., unset HISTFILE, setting HISTSIZE to 0, or disabling history collection). Such actions are frequently performed by adversaries to hinder incident response and forensic analysis by obscuring their post-exploitation activity.