Suspicious PowerShell Console History Deletion

[rule]
description = """
Identifies when a process attempts to delete PowerShell Console History. An adversary may clear the command history of a
compromised account to conceal the actions undertaken during an intrusion.
"""
id = "feb6d562-7c15-412a-8be1-48d93f382028"
license = "Elastic License v2"
name = "Suspicious PowerShell Console History Deletion"
os_list = ["windows"]
reference = ["https://attack.mitre.org/techniques/T1070/004/"]
version = "1.0.10"

query = '''
sequence by process.entity_id with maxspan=5m
[process where event.action == "start" and
 (
  process.name in~ ("powershell.exe", "rundll32.exe", "regsvr32.exe", "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe",
                  "winword.exe", "excel.exe") or
  process.executable : ("?:\\Users\\*", "?:\\Windows\\Temp\\*", "?:\\ProgramData\\*", "?:\\Windows\\Microsoft.NEt\\*") or
  (process.code_signature.trusted == false or process.code_signature.exists == false)
 ) and
 not user.id in ("S-1-5-18", "S-1-5-19")
 ]
[file where event.action == "deletion" and file.name : "ConsoleHost_history.txt"]
'''

min_endpoint_version = "7.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1070"
name = "Indicator Removal"
reference = "https://attack.mitre.org/techniques/T1070/"
[[threat.technique.subtechnique]]
id = "T1070.003"
name = "Clear Command History"
reference = "https://attack.mitre.org/techniques/T1070/003/"

[[threat.technique.subtechnique]]
id = "T1070.004"
name = "File Deletion"
reference = "https://attack.mitre.org/techniques/T1070/004/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.16.0"