PowerShell Event ID 4106 — Script block end (final execution) — SecOps Tools

Why event 4106 matters

Use with 4104 to reassemble multi-part script blocks.

How to detect it

No standalone alerting. Correlate with 4104 via ScriptBlockId.

Log source

Microsoft-Windows-PowerShell/Operational

Enable PowerShell Module Logging and Script Block Logging via GPO (Administrative Templates → Windows PowerShell).

Fields to pivot on

ScriptBlockTextPathHostApplication

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL

Event
| where EventLog == "Microsoft-Windows-PowerShell/Operational" and EventID == 4106   // Script block end (final execution)
// EventData holds: ScriptBlockText, Path, HostApplication
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc

Splunk SPL

index=* sourcetype="WinEventLog:Microsoft-Windows-PowerShell/Operational" EventCode=4106
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Script block end (final execution) — add EventData fields: ScriptBlockText, Path, HostApplication`

Hunt event 4106 in Sentinel/Defender →

Build a KQL query for this event in the KQL Query Builder.

Search all event IDs →

Open the interactive Windows Event ID lookup.

Related Script Block Logging events

4104 Script block logging — script block recorded 4105 Script block start (first execution)

Frequently asked questions

What is PowerShell Event ID 4106?

Script block end (final execution). End of a multi-part script block logging sequence.

Which log records event 4106?

Event 4106 is written to the Microsoft-Windows-PowerShell/Operational channel by Microsoft-Windows-PowerShell. Enable PowerShell Module Logging and Script Block Logging via GPO (Administrative Templates → Windows PowerShell).

How do you detect activity around event 4106?

No standalone alerting. Correlate with 4104 via ScriptBlockId.