topic Powershell Protected Script Block logging in Cortex XDR Discussions

Powershell Protected Script Block logging

RFeyertag — Sat, 15 Apr 2023 23:06:21 GMT

Hello dear community,

does Cortex XDR Pro handle also the protected event logging?

https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.3#enabling-script-block-logging

Rob

Re: Powershell Protected Script Block logging

mavraham — Sun, 16 Apr 2023 14:25:36 GMT

Hi @RFeyertag, thanks for writing to Live Community.

When you say can Cortex handle protected event logging, do you mean can it ingest the encrypted logs?

Re: Powershell Protected Script Block logging

RFeyertag — Mon, 17 Apr 2023 21:47:53 GMT

Hello @mavraham ,

yes I mean ingesting the encryted logs through the Cortex XDR Pro Agent.

Rob

Re: Powershell Protected Script Block logging

mavraham — Tue, 18 Apr 2023 13:10:47 GMT

Hi @RFeyertag,

I've checked with some of my colleagues. While the Cortex XDR agent can ingest powershell script-blok logs, it will not be able to decrypt them.

Re: Powershell Protected Script Block logging

RFeyertag — Wed, 19 Apr 2023 18:43:14 GMT

Hey @mavraham!

Thank you very much for this clarification! Have nice day!

Rob