Skip to content
PowerShellparser

Glossary

Script Block Logging

A PowerShell 5 feature that records the source of every script block the engine compiles, after de-obfuscation, to event ID 4104.

Script Block Logging is a feature added in PowerShell 5.0 (Windows 10 / WMF 5.0) that writes the text of each script block the engine compiles to event ID 4104 in the Microsoft-Windows-PowerShell/Operational log. A script block is any unit of code PowerShell compiles: a whole script, a function, a command typed at the prompt, or a string passed to Invoke-Expression. Because logging happens after the code is de-obfuscated, an -EncodedCommand or a concatenated one-liner is recorded in its expanded form (Microsoft).

Why it matters in investigations

It is the one PowerShell log that shows the code, not just a command line, which makes it the best record of in-memory payloads, downloaded scripts and decoded one-liners. Three things shape how you read it:

  • Off by default. Full logging requires the Group Policy setting "Turn on PowerShell Script Block Logging", or the registry value EnableScriptBlockLogging set to 1 under HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging.
  • Warning-level blocks anyway. Even with the policy off, PowerShell 5 logs blocks containing terms it considers suspicious at Warning level, so a host with "no logging" often still has a partial record.
  • Split blocks. Long blocks are divided across several 4104 events that share a ScriptBlockId and must be reassembled in order.

Attackers know this, so disabling it is a tampering signal in its own right: changes to the ScriptBlockLogging policy key, or reflection against PowerShell's cached Group Policy settings, are worth flagging wherever they appear.

Example

A command that turns the feature off, the kind of line to look for in history, transcripts or earlier 4104 events:

Set-ItemProperty HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging -Name EnableScriptBlockLogging -Value 0

The parser raises a high-severity logging-tampering finding for this and for references to cachedGroupPolicySettings or the PowerShell ETW provider, and separately marks Warning-level 4104 blocks.

Reassemble and decode script blocks in the PowerShell Parser, and read the 4104 forensics guide.