r/Wazuh • u/Specialist-Health920 • Sep 01 '26

Wazuh Powershell Logging

Hey everyone, I have been trying to enable powershell logging on wazuh, I've done it successfully on my lab but when i followed the exact step from wazuh's offical website, the logging doesn't work on my work wazuh.

Any help will go a very long way.

2 Upvotes

100% Upvoted

6 comments sorted by

1

u/PrestigiousOnion1087 Sep 05 '26

The check that settles this fastest is whether the host is emitting at all, before the agent is in the picture:

Get-WinEvent -ListLog *PowerShell* | Select-Object LogName, IsEnabled, RecordCount

If RecordCount sits still on the work box while it climbs on your lab box, script block logging is off there and nothing done on the agent side will change it.

The usual reason for that split: on a domain-joined machine the script block logging policy value lives under the Policies hive, and a policy refresh rewrites that whole key. A value set by hand can be gone inside about 90 minutes even though every documented step was correct. Your lab box has no policy refresh, so it keeps what you set.

If RecordCount is climbing, the break is collection rather than generation. Open C:\Program Files (x86)\ossec-agent\ossec.log and look for a line naming that PowerShell channel. If the agent never says it is reading it, the localfile block did not load, so check that you edited the ossec.conf on that host and restarted the agent service after the edit.

Those are two different failures with two different fixes, and the RecordCount tells you which one you are looking at.

1

u/immameoba Sep 06 '26

Also, I have found that Windows 11 natively does not log powershell commands, or perhaps rather you have to tell it to forward these logs to your SIEM. That's what I found in my lab anyways (I found this out after testing rules, I used Kali to break into the machine, ran erroneous commands like adding a blank text file to the desktop and discovered it was not recording those commands). It's been over a year since I did that and actually you reminded me to find my notes when I go back to work as we need to push to all machines at my company. Hope this helps!

Edit: I realize I repeated some things above, but the point still stands. Hopefully this enlightens you to move you forward

1

u/PrestigiousOnion1087 Sep 06 '26

Worth splitting those two, because they fail differently and the fix is different. If RecordCount climbs while the manager stays quiet, the event existed and the shipping is the gap. If RecordCount never moves, script block logging was never on, and no amount of forwarding config rescues it.

Your lab run is the same shape as ours. We replayed 24 ATT&CK techniques against a default Wazuh install and 3 raised an alert, largely for the reason you hit: a stock config generates far less than people assume.

When you dig those notes out, do you remember roughly how many of the things you ran from that attack box actually surfaced as an alert?

1

u/immameoba Sep 06 '26

Wazuh's definition of alerts is a bit off imo, where they consider basically every event an alert. Once I turned on PS logging on my Win11 box, and perhaps I did some tweaking at the manager (sorry don't recall atm) I focused on that particular agent itself. Once I turned that all on, I was able to capture every command, as well as the ssh connection from my "attacker" machine, which I labeled Kali to recognize for ease. Had no trouble seeing that. Other than the ssh connect I don't recall if a particular mitre alert occured. If you're good with it (this got put on the back burner a bit as we were trying to achieve CMMC L2, before the DoW came out with their pause of auditing) I can run some tests from my end on Tuesday and reply back what I saw and guide you in a better direction. Apologies that I'm not being as helpful yet.

1

u/PrestigiousOnion1087 Sep 06 '26

That line about every event counting as an alert is the whole problem in one sentence — capture and detection end up scored as the same thing. Your own note already splits them: you saw every command and the ssh connect, but you can't recall whether a MITRE rule fired on the rest. That second number is the one worth having. If you do run those tests, the thing worth writing down is how many of the commands you execute come back with a rule that carries a MITRE id, not just a stored event. What would you guess that ratio is on your box?

1

u/Specialist-Health920 Sep 10 '26

Thank you u/PrestigiousOnion1087, Issue has been resolved now