Essential Eight AH-ML2.11 Centrally log PowerShell module, script block, and transcription events
What it says
PowerShell module logging, script block logging and transcription events are centrally logged.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure logging of PowerShell activities is centralised for monitoring.
Centrally logging PowerShell activities means keeping a record of everything that's done using PowerShell, which is a powerful tool used for managing computers. This is important because if someone with bad intentions uses PowerShell to cause harm, like installing harmful software or stealing information, having these logs helps us catch them and understand what they did.
Free. Save your status, tasks and notes.
Why it matters
Without centralised PowerShell logging, malicious script blocks/modules may run without detection, delaying investigation and increasing risk of compromise or data theft.
How to implement
IT team should enable PowerShell logging by configuring Group Policy settings.
This can be done by setting up module, script block, and transcription logging in the Group Policy Management Console.
System administrator should ensure that logs are sent to a centralised logging system.
They can do this by configuring the event logs to be forwarded to a central server where they can be monitored.
Security officer should regularly review the logs for suspicious activity.
They should use a log analysis tool to look for unusual patterns or signs of unauthorised access.
System administrator should ensure the logging settings are applied consistently across all computers.
This can be checked by running a compliance report using system management tools.
Keep it running
Centrally forward PowerShell module, script block and transcription logs; alert on encoded commands, suspicious download/exec and bypass flags; routinely review for anomalies.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
Are PowerShell logging settings configured via Group Policy?
Look at
Check the Group Policy Management Console for relevant PowerShell logging settings.
Good evidence
Group Policy settings show that module, script block, and transcription logging are enabled for all applicable computers.
- Check 2 of 3What an auditor asks for
Ask for
Is there a centralised logging system in place for PowerShell activity?
Look at
Examine configuration documentation or the logging infrastructure setup.
Good evidence
Documentation confirms logs are forwarded to a central logging server and regularly reviewed.
- Check 3 of 3What an auditor asks for
Ask for
How often are the PowerShell logs reviewed and analysed?
Look at
Check log review schedules and past analysis reports.
Good evidence
A documented routine exists showing regular log reviews, with analysis reports highlighting any irregularities.
Mappings
Closest match in ASD Information Security Manual: ISM-1623, Centralised logging of PowerShell activities, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.15.
E8-AH-ML2.11 requires organisations to centrally log specific PowerShell telemetry (module logging, script block logging, and transcription). Annex A 8.15 requires logs for activities/events to be produced, stored, protected and analysed, which includes (but is not limited to) the PowerShell events in E8-AH-ML2.11. The ISO control is broader in scope and lifecycle (production through analysis and protection) while the Essential Eight control is a specific high-value Windows/PowerShell logging implementation.
ASD Information Security Manual: 10 mappings
This control is equivalent to ISM-1623.
ISM-1623 requires that PowerShell module logging, script block logging and transcription events are centrally logged for monitoring. E8-AH-ML2.11 states the same requirement for centrally logging those specific PowerShell event types. Both controls align in scope (PowerShell-specific) and intent (central collection for detection and monitoring).
This control partially overlaps ISM-0582.
ISM-0582 mandates central logging of security-relevant events on Microsoft Windows. E8-AH-ML2.11 overlaps by requiring PowerShell logs, which are Windows-host telemetry, to be centrally collected. E8-AH-ML2.11 is more specific about enabling PowerShell logging, while ISM-0582 is broader but less prescriptive about Windows subcomponents like PowerShell.
This control partially overlaps ISM-1624.
ISM-1624 requires PowerShell script block logs to be protected using Protected Event Logging to prevent tampering and unauthorised disclosure. E8-AH-ML2.11 relates by requiring PowerShell module, script block and transcription logging to be centrally logged, which is a common way to improve integrity and retention of these logs. ISM-1624 focuses on the protection mechanism for script block logs specifically, while E8-AH-ML2.11 focuses on central collection across multiple PowerShell log types rather than the specific protection method.
This control partially overlaps ISM-1889.
ISM-1889 requires central logging of command line process creation events to provide visibility of command shell activity. E8-AH-ML2.11 also requires central logging, but is specific to PowerShell module logging, script block logging and transcription events. They overlap where PowerShell activity occurs via command execution, however E8-AH-ML2.11 captures richer PowerShell content while ISM-1889 is focused on process creation for command line activity more generally.
This control partially overlaps ISM-1983.
ISM-1983 requires event logs to be forwarded to a centralised logging facility as soon as possible after they occur. E8-AH-ML2.11 mandates that specific PowerShell telemetry (module, script block and transcription events) is centrally logged, which relies on timely forwarding/centralisation to be useful for detection and investigation. E8-AH-ML2.11 is narrower in scope (PowerShell-specific) and does not itself specify the timing requirement that ISM-1983 emphasises.
This control partially overlaps ISM-2159.
ISM-2159 requires central logging of agentic AI tool calls, external requests, and outputs with sufficient detail for incident investigations. ASD Essential Eight E8-AH-ML2.11 requires central logging of PowerShell module, script block, and transcription events, which overlaps when an agentic AI invokes PowerShell as a tool (capturing the executed content and transcripts as part of the audit trail). ISM-2159 extends beyond PowerShell to any tool mechanism and explicitly requires logging of outbound requests and generated outputs, which E8-AH-ML2.11 does not address.
This control supports ISM-0580.
ISM-0580 requires an organisation to develop, implement and maintain an event logging policy to ensure events are recorded and monitored. E8-AH-ML2.11 is a specific technical logging requirement (centralising PowerShell module, script block and transcription logs) that would normally be mandated and governed by the broader policy set by ISM-0580. ISM-0580 does not prescribe PowerShell-specific telemetry, whereas E8-AH-ML2.11 does.
This control depends on ISM-0988.
E8-AH-ML2.11 requires central logging of detailed PowerShell execution artefacts so they can be monitored and investigated. ISM-0988 requires an accurate and consistent time source for event logging, which E8-AH-ML2.11 depends on to ensure PowerShell events can be correlated across endpoints and the central logging platform. ISM-0988 does not mandate any particular events be logged or centralised, but it underpins the forensic usefulness of the primary control.
This control depends on ISM-1405.
E8-AH-ML2.11 requires PowerShell module, script block, and transcription events to be centrally logged. ISM-1405 requires implementation of a centralised event logging facility, which E8-AH-ML2.11 depends on to actually collect and retain those PowerShell events in a central location. ISM-1405 is broader and does not prescribe which events to log, whereas E8-AH-ML2.11 specifies the PowerShell event types that must feed into the central facility.
This control depends on ISM-1621.
ISM-1621 requires organisations to disable or remove Windows PowerShell 2.0 to remove an older execution environment that can evade modern monitoring. E8-AH-ML2.11 requires central logging of PowerShell module, script block, and transcription events, improving detection and investigation of malicious PowerShell use. Removing PowerShell 2.0 (ISM-1621) supports E8-AH-ML2.11 by ensuring activity occurs in newer PowerShell versions where these logging capabilities are available and reliable.
ASD Essentials for enterprise IT: 2 mappings
- IT.DET-01.2Forward high-value security logs and configuration changes to central log storagePartially overlaps
This control partially overlaps IT.DET-01.2.
IT.DET-01.2 requires high-value, security-relevant event logs to be forwarded to central log storage; E8-AH-ML2.11 requires PowerShell module logging, script block logging and transcription events to be centrally logged, a specific set of those logs.
- IT.DET-04.1Continuously monitor software execution to detect malicious use of legitimate toolsPartially overlaps
This control partially overlaps IT.DET-04.1.
IT.DET-04.1 requires continuous monitoring and analysis of software execution to detect malicious use of legitimate tools; E8-AH-ML2.11 requires PowerShell module logging, script block logging and transcription events to be centrally logged, a data source for that analysis.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.