---
title: "Is command-line activity in command shells (e.g. PowerShell, bash) logged and monitored?"
url: https://insuranceposture.com/questions/network-and-logging/command-line-activity-command-shells-logged-monitored
category: "Network, logging and monitoring"
canonical_key: q_aud_009
evidence_state: attested
updated: 2026-08-24
---

# Is command-line activity in command shells (e.g. PowerShell, bash) logged and monitored?

URL: https://insuranceposture.com/questions/network-and-logging/command-line-activity-command-shells-logged-monitored
Section: Network, logging and monitoring
Evidence state: Attested, not tenant-verifiable

Modern intrusions run on tools already present on the system. Command-line logging is what makes that activity visible at all.

## What the carrier is actually asking

The carrier is asking whether commands executed in shells such as PowerShell and bash are recorded and watched. It is asking about a specific log source because that source is where living-off-the-land activity shows up.

## Why it is underwritten

Attackers stopped bringing their own tools. They use the administrative tooling already installed, which produces no malware detection and no unusual file. The command line is where the activity is visible, and it is invisible unless script block logging and process command-line auditing are enabled.

## Where the answer lives in Microsoft 365, Entra ID, and Azure

These are endpoint policy settings that Insurance Posture does not read, so this is attested. It is worth checking because the settings are off by default.

| Platform | Where the setting lives | What has to be true |
| --- | --- | --- |
| Endpoint policy | PowerShell script block logging and module logging | Script block logging enabled, which records the actual commands including obfuscated ones after decoding. Attested |
| Endpoint policy | PowerShell transcription | Transcription to a protected location, giving a readable session record |
| Endpoint policy | Process creation auditing with command line included | Enabled, since without it process events record the executable and not the arguments |
| Endpoint policy | Constrained language mode and script execution policy | Restriction as well as logging, which pairs with the application control answer |
| Collection | Whether these logs are forwarded and alerted on | Forwarded centrally with detection rules, since the volume makes local-only storage useless |

**Older PowerShell versions bypass the logging**

Version 2 of PowerShell does not honour script block logging and remains present on many systems. Removing it is a standard hardening step and it is skipped often enough that attackers still check for it.

## What a defensible yes requires

- Script block logging and process command-line auditing are enabled by policy.
- Logs are forwarded centrally, not only stored on the host.
- Detection rules exist for suspicious command patterns.
- Legacy shell versions that bypass logging are removed.
- Coverage extends to servers, which is where the highest-value command-line activity happens.

## How this answer goes wrong

The answer is yes because PowerShell logging appears in the security baseline, while the baseline applies to workstations and not to servers, and legacy PowerShell is still installed on older machines. The most valuable population is the one not covered.

## If this answer turns out to be wrong

Remote access exposure and log retention are what a forensic report describes first, which makes them the answers most often revisited after a loss. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [how an application answer ends in a denied claim](https://insuranceposture.com/glossary/claim-denial). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary).

## Frequently asked

### Does this generate too much data?

Volume is real and manageable with filtering at collection. The investigative value per gigabyte is among the highest of any source.

### What about bash and Linux?

Shell history and audit framework logging are the equivalents and are worth enabling for the same reasons.

### Is logging enough without monitoring?

It gives you forensics. Detection needs rules. Most managed detection providers include command-line detections, which makes this a good source to hand them.

### Does application control replace this?

No. Application control restricts what can run; command-line logging records what did. Carriers ask about both.

## Related questions

- [Does local logging happen per-host?](https://insuranceposture.com/questions/network-and-logging/local-logging-happen-per-host)
- [Is application allow-listing enforced on critical servers to block unauthorized programs and scripts?](https://insuranceposture.com/questions/endpoint-and-patching/application-allow-listing-enforced-critical-servers-block-unauthorized-programs)
- [Does the Applicant employ SIEM, log centralization, and audit logging across firewalls + IDS?](https://insuranceposture.com/questions/network-and-logging/applicant-employ-siem-log-centralization-audit-logging-across-firewalls)
- [Is endpoint detection & response (EDR) deployed with central monitoring?](https://insuranceposture.com/questions/endpoint-and-patching/endpoint-detection-response-deployed-central-monitoring)

---

Insurance Posture by SecValley. https://insuranceposture.com
The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished.
SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact.
Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.