PowerShell One-Liner Targeting Claude Code Chat History

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects PowerShell one-liners trying to enumerate or read files within the Claude Code conversation history directory. Claude Code stores conversation history as JSONL files under: %USERPROFILE%\.claude\projects\<hash>\<session>.jsonl Threat actors extract these files and apply regex matching to locate high-value secrets (cloud tokens, private keys, database passwords) before pivoting to infrastructure such as ESXi hosts via harvested SSH credentials.

2026-06-11 00:00:00

None

7ea7ba37-ff29-4052-a8e9-96635089e3cb

attack.credential-access attack.t1552.001

Nextron Sigma feed only (private)