powershell_history

$ target-query <path/to/target> -f powershell_history

Details

Module	dissect.target.plugins.apps.shell.powershell.PowerShellHistoryPlugin
Output	records

Module documentation

Windows PowerShell history plugin.

Function documentation

Return PowerShell command history for all users.

The PowerShell ConsoleHost_history.txt file contains information about the commands executed with PowerShell in a terminal. No data is recorded from terminal-less PowerShell sessions. Commands are saved to disk after the process has completed. PSReadLine does not save commands containing ‘password’, ‘asplaintext’, ‘token’, ‘apikey’ or ‘secret’.

References:

• https://0xdf.gitlab.io/2018/11/08/powershell-history-file.html

• https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_history?view=powershell-7.3#order-of-commands-in-the-history

• https://learn.microsoft.com/en-us/powershell/module/psreadline/about/about_psreadline?view=powershell-7.3#command-history