Data Source: Powershell Script Block Logging 4104

Created: 2024-05-22

Last Updated: 2026-10-14

ID: 5cfd0c72-d989-47a0-92f9-6edc6f8d3564

Author: Patrick Bareiss, Splunk

Description

Logs detailed content of PowerShell script blocks as they are executed, including the full command text and context for the execution.

Details

Property	Value
Source	`XmlWinEventLog:Microsoft-Windows-PowerShell/Operational`
Sourcetype	`XmlWinEventLog`
Separator	EventID

Name ▲▼	Technique ▲▼	Type ▲▼
Elevated Group Discovery with PowerView	Domain Groups	Hunting
Windows PowerShell ScheduleTask	Scheduled Task, PowerShell	Anomaly
Windows ClipBoard Data via Get-ClipBoard	Clipboard Data	Anomaly
Windows PowerShell Script TabExpansion Direct Call	PowerShell, Shared Modules	Anomaly
Get-DomainTrust with PowerShell Script Block	Domain Trust Discovery	TTP
Get WMIObject Group Discovery with Script Block Logging	Local Groups	Hunting
Windows Enable PowerShell Web Access	PowerShell	TTP
Windows Account Discovery for None Disable User Account	Local Account	Hunting
Powershell Enable SMB1Protocol Feature	Indicator Removal from Tools	TTP
PowerShell Enable PowerShell Remoting	PowerShell	Anomaly
Windows PowerShell Disable HTTP Logging	IIS Components, Disable or Modify Windows Event Log	TTP
Powershell Fileless Process Injection via GetProcAddress	Process Injection, PowerShell	TTP
Powershell Execute COM Object	PowerShell, Component Object Model Hijacking	TTP
Unloading AMSI via Reflection	PowerShell, Disable or Modify Tools	TTP
Windows PowerShell Invoke-RestMethod IP Information Collection	System Network Configuration Discovery, PowerShell, System Information Discovery	Anomaly
Windows Powershell Cryptography Namespace	PowerShell	Anomaly
Windows Find Domain Organizational Units with GetDomainOU	Domain Account	TTP
Windows Gather Victim Host Information Camera	Hardware	Anomaly
Remote Process Instantiation via DCOM and PowerShell Script Block	Distributed Component Object Model	TTP
Windows Root Domain linked policies Discovery	Domain Account	Anomaly
PowerShell Start or Stop Service	PowerShell	Anomaly
PowerShell Environment Variable Execution	PowerShell	Anomaly
Detect Empire with PowerShell Script Block Logging	PowerShell	TTP
Detect Mimikatz With PowerShell Script Block Logging	OS Credential Dumping, PowerShell	TTP
Windows Exfiltration Over C2 Via Powershell UploadString	Exfiltration Over C2 Channel	TTP
Detect Certify With PowerShell Script Block Logging	PowerShell, Steal or Forge Authentication Certificates	TTP
Windows Azure PowerShell Module Installation Via PowerShell Script	Cloud Services, Cloud Groups, Valid Accounts, Account Manipulation, Cloud Account	Anomaly
Windows Powershell Commands from DNS TXT	PowerShell, DNS	Anomaly
Mailsniper Invoke functions	Local Email Collection	TTP
Windows Linked Policies In ADSI Discovery	Domain Account	Anomaly
Windows PowerView Kerberos Service Ticket Request	Kerberoasting	TTP
Powershell Load Module in Meterpreter	PowerShell	TTP
GetWmiObject DS User with PowerShell Script Block	Domain Account	TTP
Kerberos Pre-Authentication Flag Disabled with PowerShell	AS-REP Roasting	TTP
Powershell Fileless Script Contains Base64 Encoded Content	Obfuscated Files or Information, PowerShell	TTP
Windows PowerSploit GPP Discovery	Group Policy Preferences	TTP
PowerShell Download from Code Hosting Service	PowerShell, Ingress Tool Transfer	Anomaly
Powershell Windows Defender Exclusion Commands	Disable or Modify Tools	Anomaly
Remote Process Instantiation via WinRM and PowerShell Script Block	Windows Remote Management	TTP
Windows PowerShell Script Block With Malicious String	PowerShell	TTP
Windows Level RMM PowerShell Script Installer	Remote Access Tools	Anomaly
Domain Group Discovery with Adsisearcher	Domain Groups	TTP
Interactive Session on Remote Endpoint with PowerShell	Windows Remote Management	TTP
GetDomainController with PowerShell Script Block	Remote System Discovery	TTP
Get DomainUser with PowerShell Script Block	Domain Account	TTP
GetCurrent User with PowerShell Script Block	System Owner/User Discovery	Hunting
GetAdComputer with PowerShell Script Block	Remote System Discovery	Hunting
Windows PowerShell Get CIMInstance Remote Computer	PowerShell	Anomaly
Remote Process Instantiation via WMI and PowerShell Script Block	Windows Management Instrumentation	TTP
GetDomainGroup with PowerShell Script Block	Domain Groups	TTP
Windows Powershell Logoff User via Quser	PowerShell, Account Access Removal	Anomaly
Delete ShadowCopy With PowerShell	Inhibit System Recovery	TTP
Detect Copy of ShadowCopy with Script Block Logging	Security Account Manager	TTP
Windows Powershell History File Deletion	Windows Command Shell, Clear Command History	Anomaly
Windows PowerView AD Access Control List Enumeration	Permission Groups Discovery, Domain Accounts	TTP
PowerShell Script Block With URL Chain	PowerShell, Ingress Tool Transfer	TTP
Windows PowerShell Export Certificate	Private Keys, Steal or Forge Authentication Certificates	Anomaly
GetAdGroup with PowerShell Script Block	Domain Groups	Hunting
Get-ForestTrust with PowerShell Script Block	PowerShell, Domain Trust Discovery	TTP
Windows Archive Collected Data via Powershell	Archive Collected Data	Anomaly
Disabled Kerberos Pre-Authentication Discovery With PowerView	AS-REP Roasting	TTP
Windows PowerShell Invoke-Sqlcmd Execution	PowerShell, Windows Command Shell	Hunting
Windows PowerShell WMI Win32 ScheduledJob	PowerShell	TTP
PowerShell Domain Enumeration	PowerShell	Anomaly
PowerShell 4104 Hunting	OS Credential Dumping, PowerShell, Downgrade Attack	Hunting
ServicePrincipalNames Discovery with PowerShell	Kerberoasting	TTP
Powershell Remove Windows Defender Directory	Disable or Modify Tools	Anomaly
Windows PowerView Unconstrained Delegation Discovery	Remote System Discovery	TTP
Powershell Processing Stream Of Data	PowerShell	Anomaly
Windows Get-AdComputer Unconstrained Delegation Discovery	Remote System Discovery	TTP
Get DomainPolicy with Powershell Script Block	Password Policy Discovery	TTP
PowerShell Invoke WmiExec Usage	Windows Management Instrumentation	TTP
Windows Forest Discovery with GetForestDomain	Domain Account	TTP
GetWmiObject Ds Group with PowerShell Script Block	Domain Groups	TTP
PowerShell Invoke CIMMethod CIMSession	Windows Management Instrumentation	Anomaly
Windows Cobalt Strike PowerShell Loader	PowerShell, Stage Capabilities	TTP
Get ADUserResultantPasswordPolicy with Powershell Script Block	Password Policy Discovery	TTP
Powershell Get LocalGroup Discovery with Script Block Logging	Local Groups	Hunting
Powershell Remote Services Add TrustedHost	Windows Remote Management	TTP
Windows PowerShell IIS Components WebGlobalModule Usage	IIS Components	Anomaly
Windows PowerView SPN Discovery	Kerberoasting	TTP
Recon AVProduct Through Pwh or WMI	Gather Victim Host Information	TTP
Powershell Creating Thread Mutex	Indicator Removal from Tools, PowerShell	TTP
Windows Powershell Import Applocker Policy	PowerShell, Disable or Modify Tools	Anomaly
Get ADDefaultDomainPasswordPolicy with Powershell Script Block	Password Policy Discovery	Hunting
Get ADUser with PowerShell Script Block	Domain Account	Hunting
Windows Get Local Admin with FindLocalAdminAccess	Domain Account	TTP
Windows Find Interesting ACL with FindInterestingDomainAcl	Domain Account	TTP
Powershell COM Hijacking InprocServer32 Modification	PowerShell, Component Object Model Hijacking	TTP
AdsiSearcher Account Discovery	Domain Account	TTP
GetDomainComputer with PowerShell Script Block	Remote System Discovery	TTP
Windows PowerView Constrained Delegation Discovery	Remote System Discovery	TTP
GetNetTcpconnection with PowerShell Script Block	System Network Connections Discovery	Hunting
Windows PowerShell Export PfxCertificate	Private Keys, Steal or Forge Authentication Certificates	Anomaly
Windows WinPEAS PowerShell Script Execution	System Service Discovery, System Network Configuration Discovery, System Owner/User Discovery, System Information Discovery, Gather Victim Network Information, Software, Client Configurations, Group Policy Discovery	TTP
Recon Using WMI Class	PowerShell, Gather Victim Host Information	Anomaly
PowerShell WebRequest Using Memory Stream	Fileless Storage, PowerShell, Ingress Tool Transfer	TTP
Windows Screen Capture Via Powershell	Screen Capture	TTP
Windows Exfiltration Over C2 Via Invoke RestMethod	Exfiltration Over C2 Channel	TTP
Windows Software Discovery Via PowerShell	Query Registry, PowerShell, Software Discovery	Anomaly
Windows Account Discovery for Sam Account Name	Account Discovery	Anomaly
Windows Domain Account Discovery Via Get-NetComputer	Domain Account	Anomaly
GetWmiObject Ds Computer with PowerShell Script Block	Remote System Discovery	TTP
Windows PowerShell MSIX Package Installation	PowerShell, Registry Run Keys / Startup Folder	TTP
PowerShell PInvoke Process Injection API Chain	Dynamic-link Library Injection, Thread Execution Hijacking, Asynchronous Procedure Call, Process Hollowing, Process Doppelgänging, PowerShell, Reflective Code Loading	TTP
Windows File Share Discovery With Powerview	Network Share Discovery	TTP
Remote System Discovery with Adsisearcher	Remote System Discovery	TTP
WMI Recon Running Process Or Services	Gather Victim Host Information	Anomaly
PowerShell Loading DotNET into Memory via Reflection	PowerShell	Anomaly
Powershell Using memory As Backing Store	PowerShell	TTP
Windows LAPS Password Gathering Via PowerShell Script	OS Credential Dumping, Unsecured Credentials	Anomaly
Windows ConvertTo-AADIntBackdoor Execution Via PowerShell Script	Web Protocols, Valid Accounts, Exploitation for Credential Access, Domain Trust Discovery	TTP
Allow Inbound Traffic In Firewall Rule	Remote Desktop Protocol	TTP
Exchange PowerShell Module Usage	PowerShell	TTP
Windows ESX Admins Group Creation via PowerShell	Local Account, Domain Account	TTP
Windows Default Cobalt Strike PowerShell Beacon	PowerShell, Malicious File	TTP
GetLocalUser with PowerShell Script Block	PowerShell, Local Account	Hunting
Windows Account Discovery With NetUser PreauthNotRequire	Account Discovery	Hunting
Disabled Kerberos Pre-Authentication Discovery With Get-ADUser	AS-REP Roasting	TTP
Windows PowerShell Add Module to Global Assembly Cache	IIS Components	TTP
User Discovery With Env Vars PowerShell Script Block	System Owner/User Discovery	Hunting
GetWmiObject User Account with PowerShell Script Block	PowerShell, Local Account	Hunting

Supported Apps

Splunk Add-on for Microsoft Windows (version 11.0.3)

Event Fields

+ Fields

  <span class="pill kill-chain">_time</span>
  
  <span class="pill kill-chain">ActivityID</span>
  
  <span class="pill kill-chain">Channel</span>
  
  <span class="pill kill-chain">Computer</span>
  
  <span class="pill kill-chain">dest</span>
  
  <span class="pill kill-chain">dvc</span>
  
  <span class="pill kill-chain">dvc_nt_host</span>
  
  <span class="pill kill-chain">event_id</span>
  
  <span class="pill kill-chain">EventCode</span>
  
  <span class="pill kill-chain">EventData_Xml</span>
  
  <span class="pill kill-chain">EventID</span>
  
  <span class="pill kill-chain">EventRecordID</span>
  
  <span class="pill kill-chain">eventtype</span>
  
  <span class="pill kill-chain">Guid</span>
  
  <span class="pill kill-chain">host</span>
  
  <span class="pill kill-chain">id</span>
  
  <span class="pill kill-chain">index</span>
  
  <span class="pill kill-chain">Keywords</span>
  
  <span class="pill kill-chain">Level</span>
  
  <span class="pill kill-chain">linecount</span>
  
  <span class="pill kill-chain">MessageNumber</span>
  
  <span class="pill kill-chain">MessageTotal</span>
  
  <span class="pill kill-chain">Name</span>
  
  <span class="pill kill-chain">Opcode</span>
  
  <span class="pill kill-chain">Path</span>
  
  <span class="pill kill-chain">ProcessID</span>
  
  <span class="pill kill-chain">punct</span>
  
  <span class="pill kill-chain">RecordNumber</span>
  
  <span class="pill kill-chain">ScriptBlockId</span>
  
  <span class="pill kill-chain">ScriptBlockText</span>
  
  <span class="pill kill-chain">severity</span>
  
  <span class="pill kill-chain">severity_id</span>
  
  <span class="pill kill-chain">signature</span>
  
  <span class="pill kill-chain">signature_id</span>
  
  <span class="pill kill-chain">source</span>
  
  <span class="pill kill-chain">sourcetype</span>
  
  <span class="pill kill-chain">splunk_server</span>
  
  <span class="pill kill-chain">System_Props_Xml</span>
  
  <span class="pill kill-chain">SystemTime</span>
  
  <span class="pill kill-chain">tag</span>
  
  <span class="pill kill-chain">tag::eventtype</span>
  
  <span class="pill kill-chain">Task</span>
  
  <span class="pill kill-chain">TaskCategory</span>
  
  <span class="pill kill-chain">ThreadID</span>
  
  <span class="pill kill-chain">timestamp</span>
  
  <span class="pill kill-chain">user_id</span>
  
  <span class="pill kill-chain">UserID</span>
  
  <span class="pill kill-chain">vendor_product</span>
  
  <span class="pill kill-chain">Version</span>
  
</div>

Example Log

1<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-PowerShell' Guid='{A0C1853B-5C40-4B15-8766-3CF1C58F985A}'/><EventID>4104</EventID><Version>1</Version><Level>5</Level><Task>2</Task><Opcode>15</Opcode><Keywords>0x0</Keywords><TimeCreated SystemTime='2024-03-05T08:36:27.697068800Z'/><EventRecordID>173718</EventRecordID><Correlation ActivityID='{3282F326-6ACF-0000-3BFA-8532CF6ADA01}'/><Execution ProcessID='4744' ThreadID='3940'/><Channel>Microsoft-Windows-PowerShell/Operational</Channel><Computer>ar-win-dc.attackrange.local</Computer><Security UserID='S-1-5-21-3344543075-1022232225-2459664213-500'/></System><EventData><Data Name='MessageNumber'>1</Data><Data Name='MessageTotal'>1</Data><Data Name='ScriptBlockText'>Get-ADComputer -TrustedForDelegation</Data><Data Name='ScriptBlockId'>2deff591-3d0a-452d-8965-70b16cff029e</Data><Data Name='Path'></Data></EventData></Event>

Required Output Fields

dest
signature
signature_id
user_id
vendor_product
Guid
Opcode
Name
Path
ProcessID
ScriptBlockId
ScriptBlockText

Source: GitHub | Version: 5