PowerShell Logging Tampering via Registry Modification

Collin Lairamore@Bollinmore

•updated May 18, 2026•1•0•109

Detects attempts to disable or tamper with PowerShell logging mechanisms (Script Block Logging, Module Logging, Transcription) by modifying or deleting specific registry keys or setting their values to disable logging. This activity is often performed by adversaries to evade detection.