Test your SOC · about 60 seconds

An intruder finishes the job by erasing their tracks.Does your SOC see it happen?

One real command wipes the record of everything they typed. You can run that exact command on your own machine right now — then look at your alerts and learn something true about your coverage.

technique T1070.003 · Indicator Removalseen in Medusa ransomwarewhere any Windows box

What this is about

The command history is the story of the break-in. They delete the story.

When someone works through your network by hand, PowerShell keeps a running record of every command on disk. It is the single most useful file a responder opens the morning after. Which is exactly why a careful intruder deletes it before they leave — and if your tooling doesn’t notice the deletion, the whole account of what they did goes with it.

The detection watches one thing: something deleting or truncating your PowerShell history file. Catch that, and even an attacker who cleaned up leaves you the fact that they cleaned up.

This is not hypothetical

The Medusa ransomware crew — the one the FBI, CISA and MS-ISAC put out a joint advisory on in March 2026 — does this by hand on the way out. After they have what they came for, before the encryption starts, they run a single line that deletes the PowerShell history file so the responders who arrive next can’t read back what was done.

It is documented, verbatim, in MITRE ATT&CK’s own record of the technique:

Remove-Item (Get-PSReadlineOption).HistorySavePath

No exploit. No custom tooling. A one-line command that ships with every copy of Windows, run by a normal user. The same line you are about to run yourself — and the only question is whether your SOC says a word about it.

Sources · MITRE ATT&CK T1070.003 · CISA #StopRansomware: Medusa (AA25-071A)

One built-in command

No malware to flag. It’s a normal Windows command doing a normal-looking thing.

Any account can do it

No admin rights needed. It deletes a file the user already owns.

The trail just vanishes

Miss the deletion and you lose your best record of what the intruder actually did.

The test

Run the real thing. Safely. On a box you own.

This does exactly what Medusa does — it deletes your PowerShell history file — so it produces the exact event a real detection is meant to catch. Windows simply creates the file again next time; nothing is harmed. Run it, wait a moment, then open your alerts.

Leave a mark

Run two obvious commands so there is something in the history worth hiding — the way a real session would have.

Erase it

Run Medusa’s exact line. It deletes the history file on disk. This is the moment your SOC should speak up.

Check your alerts

Open your SOC or EDR. Did anything fire on the deletion — or did the trail just quietly disappear?

test-your-soc.ps1 · PowerShell · a machine you own

# TEST YOUR SOC — run on a machine you own. Safe: Windows recreates the file.
# STEP 1 — leave something in the history worth erasing.
whoami; Get-Process | Select-Object -First 1 | Out-Null

# STEP 2 — Medusa's exact move: delete the PowerShell history file on disk.
Remove-Item (Get-PSReadlineOption).HistorySavePath -Force

# STEP 3 — open your SOC / EDR. Did anything alert on the deletion?
# Nothing to clean up. A new history file is created automatically.

It only deletes your own PowerShell history file — the same file Windows rewrites every session. No admin rights, no payload, nothing to undo.

Reading the result — honestly

Something fired

Your tooling watches the history file

Good — even an attacker who cleans up leaves you the fact that they cleaned up. That’s exactly the tripwire you want. On to the next one.

Silence

The deletion went unseen — now you know

Not a verdict on your team; a specific, fixable gap you just found in 60 seconds. The next section is exactly what to hand them to close it.

Straight with you: we never see your alerts — you’re the judge, which is also why we never touch your data. And a lab isn’t production; a test box often logs differently than the real fleet. “It fired” means your EDR flagged the history file being deleted — note that clearing only the in-memory history is a quieter action many rules won’t catch. Treat a pass as a reason to go check prod, not a finish line.

How to catch it

Missed it? Here’s the fix — take it straight to your SOC.

The detection is simple and every major SIEM already supports it: alert whenever the PowerShell history file is deleted or emptied. Here is the logic, in Sigma — the open, vendor-neutral format your team can translate into whatever you run.

powershell_history_deleted.yml

title: PowerShell Console History File Deleted
status: stable
description: An intruder deleting the on-disk command history to hide their session (T1070.003).
logsource:
  category: file_delete
  product: windows
detection:
  selection:
    TargetFilename|endswith: '\PSReadLine\ConsoleHost_history.txt'
  condition: selection
level: high
# Also watch process_creation for: Remove-Item / del / Clear-Content targeting that same path.

If your test came back silent, that rule is the whole fix. Drop it into your SIEM, or send your provider this page — “we ran this, nothing fired, here’s the detection.” Either way your coverage is better tonight than it was this morning. That’s the point.

Vendor equivalents to hand them · Elastic: Clearing Windows Console History · Splunk: ConsoleHost History File Deletion

One down · a new one every week

This is technique 01 of many.

Each one is a real attacker move, a safe way to try it, and the detection to close the gap. Run them over a few weeks and you’ll learn more about your real coverage than any dashboard has told you.

Curious how a system catches all of these at once, out of the box? That’s what we build — meet Mobula →

Credit & sources

The attacker technique and the incident are documented by MITRE ATT&CK (T1070.003) and the joint CISA / FBI / MS-ISAC advisory on Medusa. The detection is expressed in Sigma, the open detection format maintained by the SigmaHQ community, so any team can use it freely; public equivalents from Elastic and Splunk are linked above.

We show you public attacker tradecraft and public detection logic, and hand you both. Nothing here reveals anything an attacker doesn’t already have — it just makes sure the defender has it too.

CYRAY · MOBULA — SECURITY OPERATIONS, ORCHESTRATED BY AI