https://github.com/osquery/osquery logo
#windows
Title
# windows
p

packetzero

09/03/2019, 2:25 PM
Can someone verify that you are able to see powershell_events or powershell script block logging from windows_events with master or experimental branches?
m

manu

09/09/2019, 10:15 AM
yes that seems to be case. Tried with the latest windows pkg shared by @theopolis for windows in the core channel today. Even with
disable_events=true
we get windows_events and not powershell events. with
disable_events=false
we get both. Provided script logging for powershell is enabled as well.
t

theopolis

09/09/2019, 12:36 PM
This sounds dangerous. Even if events are disabled they are still occurring?
m

manu

09/09/2019, 12:59 PM
aah my bad, the flag part seems to working fine. i think i mixed up verifying 2 flagsfile.
p

packetzero

09/09/2019, 6:29 PM
thanks @manu
4 Views