Collect Command>Line Audit Logs
Description
Collect command-line audit logs. Example implementations include collecting audit logs from PowerShell®, BASH™, and remote administrative terminals.
Implementation Checklist
Tool Recommendations
SIEM platform with log management, threat detection, investigation, and compliance reporting across enterprise data sources
Cisco (Splunk) · Ingest-based or workload-based
Cloud-native SIEM and SOAR with AI-driven analytics, automated threat response, and native Azure/M365 integration
Microsoft · Pay-as-you-go (per GB ingested)
High-performance log management and observability platform designed for petabyte-scale data with real-time search
CrowdStrike · Per-GB subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Living-Off-the-Land Attack Evasion
ConfidentialityAttackers use built-in OS tools like PowerShell, cmd.exe, bash, and WMI to execute malicious commands that blend with normal administrative activity, and without command-line logging these fileless attacks leave no trace for detection or forensics.
Obfuscated PowerShell Payload Execution
IntegrityMalicious PowerShell scripts using encoded commands, AMSI bypass techniques, and module loading execute on endpoints without any record of the actual commands run, preventing detection of credential harvesting, lateral movement, or data staging.
Unauthorized Remote Administration via Command Line
ConfidentialityAttackers execute commands through remote administrative tools (PsExec, SSH, WinRM) on compromised systems, and without command-line audit logs the organization cannot detect or reconstruct the attacker's activities on each compromised host.
Vulnerabilities (When Safeguard Absent)
PowerShell Script Block and Module Logging Disabled
Windows endpoints do not have PowerShell script block logging, module logging, or transcription enabled, providing no visibility into the actual PowerShell commands and scripts executed on enterprise assets.
No Process Command-Line Auditing on Endpoints
Operating systems are not configured to include command-line arguments in process creation audit events, meaning security tools cannot see what parameters were passed to executables, hiding malicious intent behind legitimate process names.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Detection tool deployment evidence (dashboard screenshots, agent status) | Captured monthly |
| Technical | Sample alert/detection output demonstrating capability | Captured quarterly |
| Technical | SIEM dashboard showing log sources and collection status | Captured monthly |
| Record | Log review records and findings | Per review cycle |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |