PowerShell ScriptBlockLogging disabled via registry modification

Ibrahim Saud@tektrix

•updated 15 days ago•0•0•3

Detects attempts to disable PowerShell Script Block Logging via registry modification or by using the Set-ItemProperty command. Disabling this security feature prevents visibility into the actual contents of executed PowerShell scripts, which is a common tactic used by adversaries to evade detection.