PowerShell Enumeration of Claude Code Chat History

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects PowerShell scripts enumerating or reading files within the Claude Code conversation history directory. Claude Code stores conversation history as JSONL files under: %USERPROFILE%\.claude\projects\<hash>\<session>.jsonl Threat actors extract these files and apply regex matching to locate high-value secrets (cloud tokens, private keys, database passwords) before pivoting to infrastructure such as ESXi hosts via harvested SSH credentials.

2026-06-11 00:00:00

None

e78683a0-1fb7-44cc-94b5-58bbf36d6da9

attack.credential-access attack.t1552.001

Nextron Sigma feed only (private)