New Atomic - Clear PowerShell Session History (#3011)

Co-authored-by: Hare Sudhan <[email protected]>
redcanaryco · Dec 10, 2024 · ddaf498 · ddaf498
1 parent e5cbc11
commit ddaf498
Showing 1 changed file with 12 additions and 0 deletions.
diff --git a/atomics/T1070.003/T1070.003.yaml b/atomics/T1070.003/T1070.003.yaml
@@ -193,3 +193,15 @@ atomic_tests:
     cleanup_command: |
       Set-PSReadLineOption -AddToHistoryHandler $null
     name: powershell
+- name: Clear PowerShell Session History
+  description: |
+    This technique involves using the Clear-History cmdlet in PowerShell to remove all records of previously executed commands.
+    This action is often performed by attackers to eliminate traces of their activities, making incident detection and forensic 
+    investigation more challenging. By clearing the session history, adversaries aim to obfuscate their operational footprint.
+  supported_platforms:
+    - windows
+  executor:
+    command: |
+      Clear-History
+    name: powershell
+    elevation_required: false