Contact Us
Support
Partners
Downloads
Cayosoft®
Trials & Tools
Book a Demo
CTD-000190

AD domain with misconfigured PowerShell logging policies

Medium
Active Directory
Credential Access Defense Evasion Execution Persistence
v16

Signature Identity

CTD-000190
Threat ID
16
Version
IOA-IOC-IOE
Indicator Type

Threat Description

PowerShell is a legitimate administrative and automation framework, but it is frequently exploited by attackers using tools such as Mimikatz, PowerView, Empire, and Cobalt Strike. When PowerShell Script Block Logging and Module Logging are disabled, malicious activity executed through PowerShell remains invisible to security monitoring solutions such as SIEM and EDR platforms.

Enabling comprehensive PowerShell logging through Group Policy ensures that all script executions—including obfuscated, encoded, or dynamically generated commands – are captured in the Windows Event Log (Event IDs 4103 and 4104). These logs provide critical telemetry for identifying suspicious activity, enabling timely investigation, threat hunting, and detection of advanced adversary techniques.

MITRE ATT&CK: Attack Tactics

Credential Access Defense Evasion Execution Persistence

D3FEND: Defend Tactics

D3-ACH (Application Configuration Hardening)

Remediation

  1. Open the Group Policy Management Console (GPMC).
  2. Create a new Group Policy Object (GPO) or edit an existing one that targets all servers and workstations.
  3. Navigate to Computer Configuration > Policies > Administrative Templates > Windows Components > Windows PowerShell.
  4. Configure the following settings:
    • Turn on Module Logging  > Enabled, and set the Module Names value to *
    • Turn on PowerShell Script Block Logging > Enabled
    • Turn on PowerShell Transcription > Enabled
  5. Apply the GPO by running the following command: gpupdate /force

Frequently Asked Questions

What does AD domain with misconfigured PowerShell logging policies mean?

In an Active Directory environment, a misconfigured PowerShell logging policy means that the logging settings for PowerShell Script Block Logging and Module Logging are disabled. This allows malicious activity executed through PowerShell to remain undetected by security monitoring solutions.

AD domain with misconfigured PowerShell logging policies is rated medium severity because disabling these logging settings makes it harder for security teams to detect and respond to threats, but does not grant administrative control. This configuration allows attackers to maintain persistence through PowerShell-based reconnaissance.

Attackers can use tools like Mimikatz or PowerView to execute malicious activity through PowerShell without being detected due to the disabled logging settings. This allows them to evade security monitoring solutions, conduct reconnaissance, and maintain persistence in the Active Directory environment.

Cayosoft Guardian continuously monitors the logging settings for PowerShell Script Block Logging and Module Logging across the Active Directory environment domain. When these settings are found to be disabled, Guardian flags it as a security issue.

Cayosoft Guardian alerts administrators to enable comprehensive PowerShell logging through Group Policy. This ensures that all script executions, including obfuscated or dynamically generated commands, are captured in the Windows Event Log and can be detected by security monitoring solutions.

Stop AD Threats As They Happen

Cayosoft Protector provides continuous monitoring and real-time alerts across your entire Microsoft Identity stack

Free Forever
Classification
Systems
Active Directory
Themes
Infrastructure Privileged Access Management
Attack Tactics
Credential Access Defense Evasion Execution Persistence
Defend Tactics
D3-ACH (Application Configuration Hardening)
Indicator Types
IOA IOC IOE
Related Threats
CTD-000139
Kerberos Constrained Delegation: krbtgt Risks
Critical
CTD-000122
Active Directory Schema Update Permission Risks
Critical