From 8a3dcc6c9ddefb469b5bf3ebfda8dd63d41e2b6b Mon Sep 17 00:00:00 2001 From: nukunga <145279280+nukunga@users.noreply.github.com> Date: Thu, 9 Jan 2025 02:52:31 +0900 Subject: [PATCH] chore: update description for PowerShell script block logging check --- .../windows/audit/powershell-script-block-logging-disabled.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/code/windows/audit/powershell-script-block-logging-disabled.yaml b/code/windows/audit/powershell-script-block-logging-disabled.yaml index 06854676db5..50c3611e8c3 100644 --- a/code/windows/audit/powershell-script-block-logging-disabled.yaml +++ b/code/windows/audit/powershell-script-block-logging-disabled.yaml @@ -5,7 +5,7 @@ info: author: JeonSungHyun[nukunga] severity: medium description: | - Checks if PowerShell script block logging is disabled. + Checks if PowerShell script block logging is disabled. Without logging, detecting malicious PowerShell usage is difficult. impact: | Potential stealthy PowerShell attacks without detection in event logs.