Link to Rule

https://github.com/elastic/detection-rules/blob/756a7f49ba55e8eb14d038ce441a5b7e499a48a0/rules/windows/defense_evasion_disable_posh_scriptblocklogging.toml

Rule Tuning Type

False Positives - Reducing benign events mistakenly identified as threats.

Description

The "PowerShell Script Block Logging Disabled" detection rule is incorrectly flagging legitimate Intune executable files (DeviceEnroller.exe, omadmclient.exe) as suspicious.

Example Data

No response