Topic

PowerShell

Applicable to

all

History

Dec 2023

Removed

The existing controls relating to PowerShell event logs being captured and stored centrally were merged into the existing control relating to collecting PowerShell module logging, script block logging and transcription event logs. [ISM-1623, ISM-1664, ISM-1665]

Dec 2022

Blocked PowerShell script execution events are logged.

Existing controls relating to event logging were amended to increase clarity of intent and to reduce duplication of content. As a result, common guidance was consolidated into the event logging and monitoring section of the Guidelines for System Monitoring.