huntrule

Windows Registry Key Changes Disabling PowerShell Logging for Current User

Detects registry changes that disable PowerShell module/script logging and transcription by setting logging keys to DWORD 0.

FreeUnreviewedSigmahighv1
title: Windows Registry Key Changes Disabling PowerShell Logging for Current User
id: f3aa3acc-9605-47b8-b9d7-d91f1dba6089
status: test
description: This rule flags registry modifications for the currently logged-in user that set PowerShell logging-related values to DWORD 0x00000000. Attackers may disable module logging, script block logging, transcription, or script execution logging to reduce visibility and hinder detection. It relies on registry set telemetry that records changes to TargetObject paths under Microsoft\Windows\PowerShell and Microsoft\PowerShellCore, specifically matching logging configuration keys and a zero DWORD value.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-32---windows-powershell-logging-disabled
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_powershell_logging_disabled.yml
author: frack113, Huntrule Team
date: 2022-04-02
modified: 2023-08-17
tags:
  - attack.stealth
  - attack.defense-impairment
  - attack.t1564.001
  - attack.t1112
  - attack.persistence
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - \Microsoft\Windows\PowerShell\
      - \Microsoft\PowerShellCore\
    TargetObject|endswith:
      - \ModuleLogging\EnableModuleLogging
      - \ScriptBlockLogging\EnableScriptBlockLogging
      - \ScriptBlockLogging\EnableScriptBlockInvocationLogging
      - \Transcription\EnableTranscripting
      - \Transcription\EnableInvocationHeader
      - \EnableScripts
    Details: DWORD (0x00000000)
  condition: selection
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_powershell_logging_disabled/info.yml
simulation:
  - type: atomic-red-team
    name: Disable PowerShell Logging via Registry
    technique: T1112
    atomic_guid: 95b25212-91a7-42ff-9613-124aca6845a8
license: DRL-1.1
related:
  - id: fecfd1a1-cc78-4313-a1ea-2ee2e8ec27a7
    type: derived

What it detects

This rule flags registry modifications for the currently logged-in user that set PowerShell logging-related values to DWORD 0x00000000. Attackers may disable module logging, script block logging, transcription, or script execution logging to reduce visibility and hinder detection. It relies on registry set telemetry that records changes to TargetObject paths under Microsoft\Windows\PowerShell and Microsoft\PowerShellCore, specifically matching logging configuration keys and a zero DWORD value.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.