New Rules : PowerShell Console History File Access - file_access + proc_creation

[EzLucky]

Summary of the Pull Request

Adds two new rules concerning access to the PowerShell console history file.

A red team has been seen using this technique with the following command cmd.exe /q /c powershell.exe "type C:\Users\*\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt" > output_file in order to try to retrieve plaintext passwords that may have been used in PowerShell commands.

Changelog

new: PowerShell Console History File Access - file_access
new: Possible PowerShell Console History File Access Attempt - proc_creation

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions