diff --git a/code/windows/audit/powershell-script-block-logging-disabled.yaml b/code/windows/audit/powershell-script-block-logging-disabled.yaml index 06854676db5..50c3611e8c3 100644 --- a/code/windows/audit/powershell-script-block-logging-disabled.yaml +++ b/code/windows/audit/powershell-script-block-logging-disabled.yaml @@ -5,7 +5,7 @@ info: author: JeonSungHyun[nukunga] severity: medium description: | - Checks if PowerShell script block logging is disabled. + Checks if PowerShell script block logging is disabled. Without logging, detecting malicious PowerShell usage is difficult. impact: | Potential stealthy PowerShell attacks without detection in event logs.