Detections
Analytics
WN11-CC-000327 - PowerShell Transcription must be enabled on Windows 11.
Information
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.Enabling PowerShell Transcription will record detailed information from the processing of PowerShell commands and scripts. This can provide additional detail when malware has run on a system.
Solution
Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows PowerShell >> 'Turn on PowerShell Transcription' to 'Enabled'.If a centralized (versus local) Transcript output directory is preferred, configure the Transcript output directory to point to a Central Log Server or another secure location to prevent user Read, Modify, and Delete access by nonprivileged accounts.
Ensure the selected directory is write-only with Full Control access granted to Administrator and System accounts.
Enter the following registry value:
Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: \SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription
*Value Name: OutputDirectory
Value Type: REG_SZ (String Value)
* Note: 'OutputDirectory' value should be: '[custom directory path (e.g., I:\UserX_PowerShellTranscripts)]
If the folder configured (in the registry) as the Transcript output directory is not configured to provide Full Control access to Administrative and System accounts, while permitting WD, AD access for standard user accounts, issue the following commands:
Open 'Command Prompt (Admin)'.
1. If the directory configured to store PowerShell Transcription logs does not exist:
mkdir C:\ProgramData\PS_Transcript
2. Assign appropriate permissions to Administrators group and System account:
icacls 'C:\ProgramData\PS_Transcript' /inheritance:r /grant:r 'Administrators:(OI)(CI)(F)' /grant:r 'SYSTEM':(OI)(CI)(F)
3. Assign appropriate permissions to user groups:
icacls 'C:\ProgramData\PS_Transcript' /grant:r 'Users':(OI)(CI)(WD,AD) /t /c
icacls 'C:\ProgramData\PS_Transcript' /grant:r 'Authenticated Users':(OI)(CI)(WD,AD) /t /c
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_11_V2R11_STIG.zip
Item Details
Audit Name: DISA Microsoft Windows 11 STIG v2r11
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-3, CAT|II, CCI|CCI-000134, Rule-ID|SV-253415r1259992_rule, STIG-ID|WN11-CC-000327, Vuln-ID|V-253415
Plugin: Windows
Control ID: ad1ea08b7cba33a1e548cf2408db26fe1a9c9aee58b71cdfce234c9518d33501