PowerShell Script Block & Operational Logs

Location

Description

PowerShell Operational log and Script Block Logging (Event 4104) capturing the full text of executed scripts, including those decoded at runtime from Base64 or obfuscation layers.

Forensic Value

Script Block Logging defeats obfuscation by recording scripts after all decoding layers are resolved, exposing the final plaintext payload. This is often the only artifact that reveals encoded download cradles, credential harvesting, and in-memory-only tools like Invoke-Mimikatz. Module logging (Event 4103) adds pipeline execution details for reconstruction.

Tools Required