Title
#windows
packetzero

packetzero

09/03/2019, 2:25 PM
Can someone verify that you are able to see powershell_events or powershell script block logging from windows_events with master or experimental branches?
manu

manu

09/09/2019, 10:15 AM
yes that seems to be case. Tried with the latest windows pkg shared by @theopolis for windows in the core channel today. Even with
disable_events=true
we get windows_events and not powershell events. with
disable_events=false
we get both. Provided script logging for powershell is enabled as well.
theopolis

theopolis

09/09/2019, 12:36 PM
This sounds dangerous. Even if events are disabled they are still occurring?
manu

manu

09/09/2019, 12:59 PM
aah my bad, the flag part seems to working fine. i think i mixed up verifying 2 flagsfile.
packetzero

packetzero

09/09/2019, 6:29 PM
thanks @manu