New Rules : PowerShell Console History File Access - file_access + proc_creation

[EzLucky]

Summary of the Pull Request

Adds two new rules concerning access to the PowerShell console history file.

A red team has been seen using this technique with the following command cmd.exe /q /c powershell.exe "type C:\Users\*\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt" > output_file in order to try to retrieve plaintext passwords that may have been used in PowerShell commands.

Changelog

new: PowerShell Console History File Access - file_access
new: Possible PowerShell Console History File Access Attempt - proc_creation

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[nasbench]

Powershell, AV, Windows itself and many other processes will request access to this file.

The filters have to be more strict or the rule will generate a lot of FPs

[nasbench]

If the rule is looking for access attempt, why exclude notepad? Its the easiest way to access that file for an attacker.

I know the aim is to reduce FP from admin. But that should be left to the rule user as it is env specific.