Windows Registry Key Changes Disabling PowerShell Logging for Current User
Detects registry changes that disable PowerShell module/script logging and transcription by setting logging keys to DWORD 0.
- Product
- windows
- Category
- registry_set
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-04-02
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags registry modifications for the currently logged-in user that set PowerShell logging-related values to DWORD 0x00000000. Attackers may disable module logging, script block logging, transcription, or script execution logging to reduce visibility and hinder detection. It relies on registry set telemetry that records changes to TargetObject paths under Microsoft\Windows\PowerShell and Microsoft\PowerShellCore, specifically matching logging configuration keys and a zero DWORD value.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-32---windows-powershell-logging-disabled
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_powershell_logging_disabled.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Registry Key Changes Disabling PowerShell Logging for Current User
id: f3aa3acc-9605-47b8-b9d7-d91f1dba6089
status: test
description: This rule flags registry modifications for the currently logged-in user that set PowerShell logging-related values to DWORD 0x00000000. Attackers may disable module logging, script block logging, transcription, or script execution logging to reduce visibility and hinder detection. It relies on registry set telemetry that records changes to TargetObject paths under Microsoft\Windows\PowerShell and Microsoft\PowerShellCore, specifically matching logging configuration keys and a zero DWORD value.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-32---windows-powershell-logging-disabled
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_powershell_logging_disabled.yml
author: frack113, Huntrule Team
date: 2022-04-02
modified: 2023-08-17
tags:
- attack.stealth
- attack.defense-impairment
- attack.t1564.001
- attack.t1112
- attack.persistence
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains:
- \Microsoft\Windows\PowerShell\
- \Microsoft\PowerShellCore\
TargetObject|endswith:
- \ModuleLogging\EnableModuleLogging
- \ScriptBlockLogging\EnableScriptBlockLogging
- \ScriptBlockLogging\EnableScriptBlockInvocationLogging
- \Transcription\EnableTranscripting
- \Transcription\EnableInvocationHeader
- \EnableScripts
Details: DWORD (0x00000000)
condition: selection
falsepositives:
- Unknown
level: high
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_powershell_logging_disabled/info.yml
simulation:
- type: atomic-red-team
name: Disable PowerShell Logging via Registry
technique: T1112
atomic_guid: 95b25212-91a7-42ff-9613-124aca6845a8
license: DRL-1.1
related:
- id: fecfd1a1-cc78-4313-a1ea-2ee2e8ec27a7
type: derived