drop 4104 evtx csv or psreadline history · detect clear-history · file deletion · script block gaps · export csv · runs locally
input
drop evtx csv or history txt
or click
powershell operational 4100/4103/4104 · ConsoleHost_history.txt
drop powershell 4104 csv or ConsoleHost_history.txt