PowerShellConsole
PowerShell Console Log File
- 5 paths
*_history.txt*.ps1*.config- Per-user data
- Version 1.2
- Mike Cary, 2thewes, Vikas Singh
Paths on disk
5 paths
References
6 links
- vikas-singh.notion.site/PowerShell-Command-History-Forensics-81a35c4f0b824c2b95c28f98134d49a4?pvs=4(opens in new tab)
- community.sophos.com/malware/b/blog/posts/powershell-command-history-forensics(opens in new tab)
- darizotas.blogspot.com/2018/10/forensics-powershell-artifacts.html(opens in new tab)
- digital-forensics.sans.org/media/DFPS_FOR508_v4.4_1-19.pdf(opens in new tab)
- forensafe.com/blogs/powershell.html(opens in new tab)
- learn.microsoft.com/en-us/powershell/module/psreadline/about/about_psreadline?view=powershell-7.3(opens in new tab)