Custom Detection Rules for PowerShell (W/ Script Block Logging Enabled). Is it even worth it?

Hello,

In my work environment, we are considering enabling PowerShell Script Block logging because EDR tools don’t natively capture PowerShell interactive session commands or script contents unless a live investigation is conducted (and only captures initial process command lines with PowerShell.exe that started the process). Since we already ingest Windows event logs, enabling script block logging seems logical to enhance our threat hunting and forensic capabilities.

After enabling it enterprise-wide, I’m
thinking of creating custom detection rules based on the …

block blueteamsec capture command commands custom detection detection rules don edr environment hello investigation live logging powershell powershell script process rules script script block logging session tools work work environment