PowerShell history saving disabled via Set-PSReadLineOption

1title: PowerShell history saving disabled via Set-PSReadLineOption2id: 81636d9f-bb72-4455-b584-85c66c4b13053status: experimental4description: |5  AN1557 names `Set-PSReadLineOption` with `SaveNothing` or an altered6  `HistorySavePath` as the observable, and PowerShell script block logging is7  the one feed in the brief that can carry the cmdlet's arguments verbatim.8  Script block logging is off by default and requires the "Turn on9  PowerShell Script Block Logging" Group Policy (or the equivalent10  `HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging`11  registry key) enabled before EventID 4104 exists at all; without it this12  rule is blind, not quiet. This rule matches the cmdlet name together with13  either the `SaveNothing`14  save-style value or a `HistorySavePath` argument pointed at a null15  destination (`$null`, `NUL`, or `/dev/null`, the forms available under16  Windows PowerShell and PowerShell 7). It is deliberately narrower than17  matching `HistorySavePath` alone, since that argument also appears in18  benign scripts that read or display the current path without redirecting19  it anywhere. AN1555 (Linux) and AN1556 (macOS) are not authored under this20  technique. AN1555's own log source is `auditd:SYSCALL::execve` matching21  `unset`/`export` of `HISTFILE`/`HISTCONTROL` — but `unset` and `export` are22  bash builtins with no external binary of that name, so they never reach23  `execve()` and this selector could never fire, the same class of dead24  selector AUTHORING.md documents for Java/Python wrappers on this same log25  source. AN1556's macOS unifiedlog leg gives no field or message pattern at26  all, only the prose "Set or unset HIST* variables in shell environment."27  T1070.003's published rule for this corpus explicitly declines28  `Set-PSReadLineOption -HistorySaveStyle SaveNothing` as out of scope for29  clearing console history and reserves it for this technique — this rule is30  that reservation being claimed. It does not see history suppressed through31  `$env:PSReadLineHistorySaveStyle` set before the module loads, through a32  compiled or C#-hosted PowerShell runspace with no script block to log, or33  through direct deletion/truncation of the underlying history file, which is34  T1070.003's ground, not this one's.35  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0563, not hand-written and not tested by its author. Any lab result is on this rule's own page.36references:37  - https://attack.mitre.org/techniques/T169038  - https://attack.mitre.org/detectionstrategies/DET056339author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)40date: 2026-08-1841tags:42  - attack.defense-evasion43  - attack.t169044logsource:45  product: windows46  service: powershell47detection:48  selection_event:49    EventID: 410450  selection_cmdlet:51    ScriptBlockText|contains: 'Set-PSReadLineOption'52  selection_savenothing:53    ScriptBlockText|contains: 'SaveNothing'54  selection_nullpath:55    ScriptBlockText|contains:56      - 'HistorySavePath $null'57      - 'HistorySavePath NUL'58      - 'HistorySavePath /dev/null'59  condition: selection_event and selection_cmdlet and (selection_savenothing or selection_nullpath)60falsepositives:61  - "Security-hardening baselines for shared jump hosts and PAM bastions that deliberately set SaveNothing at profile load to stop credentials typed during a privileged session from persisting into a shared history file — a legitimate control that produces the identical script block."62  - "Self-hosted CI/CD runner initialization scripts (Azure DevOps, GitHub Actions Windows runners) that disable PSReadLine history at session start so secrets echoed during a pipeline run are never written to disk on a reused runner."63  - "Detection-engineering and atomic-test validation runs that execute this exact cmdlet and argument to demonstrate or self-test the analytic rather than to conceal anything."64level: low