Event ID 4104: Creating Scriptblock text (script block logging)
Records the actual PowerShell code that runs, after it has been decoded, including code passed with -EncodedCommand.
- Log
- Microsoft-Windows-PowerShell/Operational
- Category
- Execution
Why it matters
- The best record of malicious PowerShell, because it captures code after Base64 and other layers are removed.
- Windows logs some suspicious script blocks as warnings even without the policy, but turning it on gives full coverage.
- Long scripts are split across several 4104 events with the same ScriptBlock ID.
What to check
Read the ScriptBlock Text. Look for download cradles (Net.WebClient, Invoke-WebRequest, IEX), AMSI bypasses and credential tools. Join parts by ScriptBlock ID.
How to turn it on
Group Policy: Administrative Templates > Windows Components > Windows PowerShell > Turn on PowerShell Script Block Logging.
MITRE ATT&CK
- T1059.001 PowerShell