Skip to content

Instantly share code, notes, and snippets.

@tuantmb
Forked from hook-s3c/info.txt
Created May 31, 2021 09:18
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save tuantmb/c77e64bf526e87b2163c8cfad1380e5f to your computer and use it in GitHub Desktop.
Save tuantmb/c77e64bf526e87b2163c8cfad1380e5f to your computer and use it in GitHub Desktop.
Disable Powershell logging
Logs are held by default in the user profile:
\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt
this directory also hosts per-application logs
--------------------------------------------------------------
Disable Logging...
remove-module psreadline
Set-PSReadlineOption -HistorySavePath path
- to change the default path of log file
Set-PSReadlineOption –HistorySaveStyle SaveNothing
- to disable logging feature
Other;
- Get-Credential
- variable = Read-Host -AsSecureString "mysecurestring"
--------------------------------------------------------------
Scrubbing;
del (Get-PSReadlineOption).HistorySavePath
--------------------------------------------------------------
Extracting logs with python;
https://github.com/KalibRx/PoshHarvestPy
--------------------------------------------------------------
Sources...
https://twitter.com/DissectMalware/status/1062879286749773824
https://twitter.com/nikhil_mitt/status/1062382974744887296
https://twitter.com/DevinStokes/status/1062760239781408768
https://twitter.com/IISResetMe/status/1062594906626187264
https://blogs.msdn.microsoft.com/stevelasker/2016/03/25/clear-history-powershell-doesnt-clear-the-history-3/
https://0xdf.gitlab.io/2018/11/08/powershell-history-file.html
https://yunolikerobots.com/blog/f/log-everything-right
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment