Although powershell-protect can record events to Application event log on Windows, if the message size of an event is too big, the message will not be recorded due to a limitation or a bug while block and file actions work correctly.
I confirmed it when It detected some of powershell empire agent and modules such as Invoke-Empire and Invoke-Mimikatz.
To avoid this problem, I pull-requested PR#5.
Although powershell-protect can record events to Application event log on Windows, if the message size of an event is too big, the message will not be recorded due to a limitation or a bug while block and file actions work correctly.
I confirmed it when It detected some of powershell empire agent and modules such as Invoke-Empire and Invoke-Mimikatz.
To avoid this problem, I pull-requested PR#5.