InstallFix Disables Script Block Logging

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•0•0•1

Detects registry or PowerShell changes that disable script block logging, module logging, or transcription before payload execution. This rule specifically looks for modifications to the PowerShell ScriptBlockLogging registry key where the EnableScriptBlockLogging or EnableScriptBlockInvocationLogging values are set to 0, indicating a disablement of these logging features.