PowerShell Logging Disabled Via Registry Key Tampering
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects changes to the registry for the currently logged-in user. In order to disable PowerShell module logging, script block logging or transcription and script execution logging
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Registry value modified" AND (OBJECTNAME contains "\Microsoft\Windows\PowerShell\,\Microsoft\PowerShellCore" OR ((OBJECTNAME endswith "\Microsoft\Windows\PowerShell" AND isExist(OBJECTVALUENAME)) OR (OBJECTNAME endswith "\Microsoft\PowerShellCore" AND isExist(OBJECTVALUENAME)))) AND (OBJECTNAME endswith "\ModuleLogging\EnableModuleLogging,\ScriptBlockLogging\EnableScriptBlockLogging,\ScriptBlockLogging\EnableScriptBlockInvocationLogging,\Transcription\EnableTranscripting,\Transcription\EnableInvocationHeader,\EnableScripts" OR (OBJECTNAME endswith "\ModuleLogging,\ScriptBlockLogging,\ScriptBlockLogging,\Transcription,\Transcription" AND (OBJECTVALUENAME = "EnableModuleLogging,EnableScriptBlockLogging,EnableScriptBlockInvocationLogging,EnableTranscripting,EnableInvocationHeader" OR OBJECTVALUENAME endswith "EnableScripts"))) AND (INFORMATION = "DWORD (0x00000000)" OR (CHANGES = 0 AND NEWTYPE = "REG_DWORD")) select Action1.HOSTNAME,Action1.MESSAGE,Action1.OBJECTNAME,Action1.PROCESSNAME,Action1.PREVVAL,Action1.CHANGES
Detection
Execution Mode
realtime
Log Sources
Windows
Author
frack113
