PowerShell Event ID 4104 — Script block logging — script block recorded

The complete text of a PowerShell script block is recorded. Applies to PowerShell v5+. Includes auto-triggered logging for suspicious content even when not globally enabled (suspicious script block recording).

Why event 4104 matters

The gold standard for PowerShell detection. Captures: full decoded script content (even after deobfuscation), encoded commands expanded, AMSI bypass attempts, complete attack tool code (even when loaded in-memory). Script block logging auto-triggers for suspicious patterns even without explicit policy. Reveals the actual malicious PowerShell regardless of obfuscation layers.

How to detect it

MUST ENABLE: HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging. Alert: MessageNumber=1 (first block) with suspicious content — Invoke-Expression, IEX, [Reflection.Assembly]::Load, encoded payloads. Alert: known attack strings (mimikatz, invoke-shellcode, amsiutils, bypass). Alert: long random-character strings (obfuscated code). This is the most valuable PowerShell logging event.

MITRE ATT&CK mapping

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

title: Suspicious PowerShell Script Block Content
status: stable
description: Script block logging captures malicious PowerShell patterns
author: theadminstack.com
date: 2026/05/16
logsource:
    product: windows
    service: powershell
detection:
    selection:
        EventID: 4104
        ScriptBlockText|contains:
            - 'Invoke-Mimikatz'
            - 'Invoke-Shellcode'
            - 'AmsiUtils'
            - 'amsiContext'
            - 'bypass'
            - 'Invoke-ReflectivePEInjection'
            - '[Reflection.Assembly]::Load'
    condition: selection
falsepositives:
    - Security testing and authorized red team operations
level: high
tags:
    - attack.execution
    - attack.t1059.001
    - attack.defense_evasion

Event
| where EventLog == "Microsoft-Windows-PowerShell/Operational" and EventID == 4104   // Script block logging — script block recorded
// EventData holds: ScriptBlockText, Path
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc

index=* sourcetype="WinEventLog:Microsoft-Windows-PowerShell/Operational" EventCode=4104
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Script block logging — script block recorded — add EventData fields: ScriptBlockText, Path`

References

• learn.microsoft.com

Related Script Block Logging events