Lion Cipher Lab
Recover an attacker's PowerShell commands from the PSReadLine history file
- Digital Forensics & IR (DFIR)
- Intermediate
- ~60 min
- Free · no account required
Why it matters
When someone breaks into a Windows machine and opens PowerShell, they type commands, and a small text file in their profile quietly writes every one of those commands down. That file is often the fastest answer a responder gets to the question 'what did they actually do here?' It is also easy to over-trust. It has no timestamps. It never sees the inside of a script. It deliberately skips lines that look like they contain a password. And an attacker can switch it off with one command. This lab teaches you to read it the way an investigator should: collect every copy, triage it quickly, then…
What you'll learn
- Locating every PSReadLine history file on a host: per user, per PowerShell host (ConsoleHost, VS Code and others)
- Explaining exactly what the history file records and what it never records (timestamps, output, script contents, filtered lines)
- Triaging history files at scale with a small, readable rule set and reading its false positives
- Putting time back on a timestamp-less artifact by anchoring it to Script Block Logging (Event ID 4104)
- Measuring evidence coverage of two sources against an answer key instead of trusting either one
- Recognising the anti-forensic moves against this artifact (Clear-History, HistorySaveStyle SaveNothing, deleting the file) and what each one does and does not erase
Steps in this lab
- What the PSReadLine history file is, and why responders open it first
- Where it lives -- one file per user, per host
- What it does NOT record -- the five blind spots
- Optional: see it on your own machine (harmless commands only)
- Build the evidence set
- Triage every history file at once
- Put time back on the timeline with 4104
- Measure what each source saw, and name every miss
- When to reach for this artifact, and how a pro does it better