windows_powershell_events.conf

{
  "platform": "windows",
  "description": "ATT&CK: T1086,T1064",
  "queries": {
	"powershell_events_script_blocks": {
	    "query": "select * from powershell_events;",
	    "interval": 3600,
	    "description": "Powershell script blocks reconstructed to their full script content, this table requires script block logging to be enabled. - ATT&CK T1086,T1064",
	    "removed": false
	}
    }
}