Elastic medium stable eql

PowerShell Script Block Logging Disabled

Detects registry changes that disable PowerShell Script Block Logging. Attackers may disable this logging to conceal their activities in the host and evade detection.

View Source

Detection Logic

registry where host.os.type == "windows" and event.type == "change" and
    registry.value : "EnableScriptBlockLogging" and
    registry.data.strings : ("0", "0x00000000") and
    not process.executable : (
          "?:\\Windows\\System32\\svchost.exe",
          "?:\\Windows\\System32\\DeviceEnroller.exe",
          "?:\\Windows\\system32\\omadmclient.exe",
          "?:\\Program Files\\Trend Micro\\Cloud Endpoint\\CloudEndpointService.exe",
          "?:\\Program Files (x86)\\N-able Technologies\\AutomationManagerAgent\\AutomationManager.AgentService.exe",
          
          /* Crowdstrike specific exclusion as it uses NT Object paths */
          "\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe",
          "\\Device\\HarddiskVolume*\\Windows\\System32\\DeviceEnroller.exe",
          "\\Device\\HarddiskVolume*\\Windows\\system32\\omadmclient.exe",
          "\\Device\\HarddiskVolume*\\Program Files\\Trend Micro\\Cloud Endpoint\\CloudEndpointService.exe",
          "\\Device\\HarddiskVolume*\\Program Files (x86)\\N-able Technologies\\AutomationManagerAgent\\AutomationManager.AgentService.exe"
    )

Field Validations

Loading…

Comments (0)

Loading comments...