From 0916deb7baeb8c223f4e4d0221372f252c1e9a21 Mon Sep 17 00:00:00 2001 From: whx Date: Thu, 27 Oct 2022 23:11:38 +0200 Subject: [PATCH] added powershell user history --- post exploitation/docs/windows/powershell_logs.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/post exploitation/docs/windows/powershell_logs.md b/post exploitation/docs/windows/powershell_logs.md index 15a6f53..0f7a819 100644 --- a/post exploitation/docs/windows/powershell_logs.md +++ b/post exploitation/docs/windows/powershell_logs.md @@ -1,5 +1,11 @@ # Powershell Logs +## Powershell User History + +```sh +cd $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt +``` + ## Transcript Logs * Enable via