Start of script block execution logging. Indicates the beginning of a script block that will be logged across one or more 4104 events.
Use with 4104 to reassemble multi-part script blocks. First 4104 event of a large script.
No standalone alerting. Use to correlate multi-part 4104 events via RunspaceId and ScriptBlockId.
ScriptBlockTextPathHostApplication Starting points — adapt the log source, projected fields and thresholds for your environment.
Event
| where EventLog == "Microsoft-Windows-PowerShell/Operational" and EventID == 4105 // Script block start (first execution)
// EventData holds: ScriptBlockText, Path, HostApplication
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Microsoft-Windows-PowerShell/Operational" EventCode=4105
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# Script block start (first execution) — add EventData fields: ScriptBlockText, Path, HostApplication`Script block start (first execution). Start of script block execution logging. Indicates the beginning of a script block that will be logged across one or more 4104 events.
Event 4105 is written to the Microsoft-Windows-PowerShell/Operational channel by Microsoft-Windows-PowerShell. Enable PowerShell Module Logging and Script Block Logging via GPO (Administrative Templates → Windows PowerShell).
No standalone alerting. Use to correlate multi-part 4104 events via RunspaceId and ScriptBlockId.