powershell_history
#
$ target-query <path/to/target> -f powershell_history
Module |
|
Output |
|
Module documentation
No documentation
Function documentation
Return PowerShell command history for all users.
The PowerShell ConsoleHost_history.txt file contains information about the commands executed with PowerShell in a terminal. No data is recorded from terminal-less PowerShell sessions. Commands are saved to disk after the process has completed. PSReadLine does not save commands containing ‘password’, ‘asplaintext’, ‘token’, ‘apikey’ or ‘secret’.