win:powershell 4104
Script block logging (script block text)
Microsoft-Windows-PowerShell/Operational: records the text of script blocks as they are processed, including de-obfuscated content; long scripts are split across several events.
- Log source
- PowerShell logging
- Host type
- Windows (workstation, member server, domain controller)
- How to enable
- Turn on PowerShell Script Block Logging (GPO: Windows Components > Windows PowerShell; HKLM\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging EnableScriptBlockLogging=1). PowerShell 7 logs to PowerShellCore/Operational.
- Tier, host type
- Minimum
- Techniques
- 56
- Rules depending on it
- Splunk 122, Sigma 181, Elastic 14
Why this tier
CISA/ASD; DISA STIG (server); DISA STIG (workstation); NSA
By role
| Role | Tier | Basis |
|---|---|---|
| Windows workstation | Minimum | CISA/ASD; DISA STIG (workstation); NSA |
| Windows member server | Minimum | CISA/ASD; DISA STIG (server); NSA |
| Windows domain controller | Minimum | CISA/ASD; DISA STIG (server); NSA |
| Windows web server (IIS), internet-facing | Minimum | CISA/ASD; DISA STIG (server); NSA |
Techniques it helps detect
- T1007 System Service Discovery
- T1010 Application Window Discovery
- T1012 Query Registry
- T1016 System Network Configuration Discovery
- T1016.001 Internet Connection Discovery
- T1016.002 Wi-Fi Discovery
- T1027.018 Invisible Unicode
- T1033 System Owner/User Discovery
- T1036.001 Invalid Code Signature
- T1036.002 Right-to-Left Override
- T1049 System Network Connections Discovery
- T1056.002 GUI Input Capture
- T1059.001 PowerShell
- T1069 Permission Groups Discovery
- T1069.002 Domain Groups
- T1070.003 Clear Command History
- T1070.004 File Deletion
- T1070.005 Network Share Connection Removal
- T1070.008 Clear Mailbox Data
- T1082 System Information Discovery
- T1087.002 Domain Account
- T1087.003 Email Account
- T1114 Email Collection
- T1114.002 Remote Email Collection
- T1114.003 Email Forwarding Rule
- T1124 System Time Discovery
- T1132.001 Standard Encoding
- T1132.002 Non-Standard Encoding
- T1135 Network Share Discovery
- T1197 BITS Jobs
- T1201 Password Policy Discovery
- T1204.004 Malicious Copy and Paste
- T1205 Traffic Signaling
- T1216 System Script Proxy Execution
- T1216.001 PubPrn
- T1216.002 SyncAppvPublishingServer
- T1217 Browser Information Discovery
- T1218.003 CMSTP
- T1218.004 InstallUtil
- T1218.009 Regsvcs/Regasm
- T1218.013 Mavinject
- T1218.014 MMC
- T1222 File and Directory Permissions Modification
- T1222.001 Windows Permissions
- T1480 Execution Guardrails
- T1480.001 Environmental Keying
- T1505.002 Transport Agent
- T1534 Internal Spearphishing
- T1556.005 Reversible Encryption
- T1564.008 Email Hiding Rules
- T1564.011 Ignore Process Interrupts
- T1615 Group Policy Discovery
- T1674 Input Injection
- T1679 Selective Exclusion
- T1690 Prevent Command History Logging
- T1700 AI-Enabled Exfiltration
Rules that depend on it
Splunk 122
- AdsiSearcher Account Discovery
- Allow Inbound Traffic In Firewall Rule
- Delete ShadowCopy With PowerShell
- Detect Certify With PowerShell Script Block Logging
- Detect Copy of ShadowCopy with Script Block Logging
- Detect Empire with PowerShell Script Block Logging
- Detect Mimikatz With PowerShell Script Block Logging
- Disabled Kerberos Pre-Authentication Discovery With Get-ADUser
- Disabled Kerberos Pre-Authentication Discovery With PowerView
- Domain Group Discovery with Adsisearcher
- Elevated Group Discovery with PowerView
- Exchange PowerShell Module Usage
- Get ADDefaultDomainPasswordPolicy with Powershell Script Block
- Get ADUser with PowerShell Script Block
- Get ADUserResultantPasswordPolicy with Powershell Script Block
- Get DomainPolicy with Powershell Script Block
- Get DomainUser with PowerShell Script Block
- Get WMIObject Group Discovery with Script Block Logging
- Get-DomainTrust with PowerShell Script Block
- Get-ForestTrust with PowerShell Script Block
- GetAdComputer with PowerShell Script Block
- GetAdGroup with PowerShell Script Block
- GetCurrent User with PowerShell Script Block
- GetDomainComputer with PowerShell Script Block
- GetDomainController with PowerShell Script Block
- GetDomainGroup with PowerShell Script Block
- GetLocalUser with PowerShell Script Block
- GetNetTcpconnection with PowerShell Script Block
- GetWmiObject DS User with PowerShell Script Block
- GetWmiObject Ds Computer with PowerShell Script Block
- GetWmiObject Ds Group with PowerShell Script Block
- GetWmiObject User Account with PowerShell Script Block
- Interactive Session on Remote Endpoint with PowerShell
- Kerberos Pre-Authentication Flag Disabled with PowerShell
- Mailsniper Invoke functions
- PowerShell 4104 Hunting
- PowerShell Domain Enumeration
- PowerShell Download from Code Hosting Service
- PowerShell Enable PowerShell Remoting
- PowerShell Environment Variable Execution
- PowerShell Invoke CIMMethod CIMSession
- PowerShell Invoke WmiExec Usage
- PowerShell Loading DotNET into Memory via Reflection
- PowerShell PInvoke Process Injection API Chain
- PowerShell Script Block With URL Chain
- PowerShell Start or Stop Service
- PowerShell WebRequest Using Memory Stream
- Powershell COM Hijacking InprocServer32 Modification
- Powershell Creating Thread Mutex
- Powershell Enable SMB1Protocol Feature
- Powershell Execute COM Object
- Powershell Fileless Process Injection via GetProcAddress
- Powershell Fileless Script Contains Base64 Encoded Content
- Powershell Get LocalGroup Discovery with Script Block Logging
- Powershell Load Module in Meterpreter
- Powershell Processing Stream Of Data
- Powershell Remote Services Add TrustedHost
- Powershell Remove Windows Defender Directory
- Powershell Using memory As Backing Store
- Powershell Windows Defender Exclusion Commands
- Recon AVProduct Through Pwh or WMI
- Recon Using WMI Class
- Remote Process Instantiation via DCOM and PowerShell Script Block
- Remote Process Instantiation via WMI and PowerShell Script Block
- Remote Process Instantiation via WinRM and PowerShell Script Block
- Remote System Discovery with Adsisearcher
- ServicePrincipalNames Discovery with PowerShell
- Unloading AMSI via Reflection
- User Discovery With Env Vars PowerShell Script Block
- WMI Recon Running Process Or Services
- Windows Account Discovery With NetUser PreauthNotRequire
- Windows Account Discovery for None Disable User Account
- Windows Account Discovery for Sam Account Name
- Windows Archive Collected Data via Powershell
- Windows Azure PowerShell Module Installation Via PowerShell Script
- Windows ClipBoard Data via Get-ClipBoard
- Windows Cobalt Strike PowerShell Loader
- Windows ConvertTo-AADIntBackdoor Execution Via PowerShell Script
- Windows Default Cobalt Strike PowerShell Beacon
- Windows Domain Account Discovery Via Get-NetComputer
- Windows ESX Admins Group Creation via PowerShell
- Windows Enable PowerShell Web Access
- Windows Exfiltration Over C2 Via Invoke RestMethod
- Windows Exfiltration Over C2 Via Powershell UploadString
- Windows File Share Discovery With Powerview
- Windows Find Domain Organizational Units with GetDomainOU
- Windows Find Interesting ACL with FindInterestingDomainAcl
- Windows Forest Discovery with GetForestDomain
- Windows Gather Victim Host Information Camera
- Windows Get Local Admin with FindLocalAdminAccess
- Windows Get-AdComputer Unconstrained Delegation Discovery
- Windows LAPS Password Gathering Via PowerShell Script
- Windows Level RMM PowerShell Script Installer
- Windows Linked Policies In ADSI Discovery
- Windows PowerShell Add Module to Global Assembly Cache
- Windows PowerShell Disable HTTP Logging
- Windows PowerShell Export Certificate
- Windows PowerShell Export PfxCertificate
- Windows PowerShell Get CIMInstance Remote Computer
- Windows PowerShell IIS Components WebGlobalModule Usage
- Windows PowerShell Invoke-RestMethod IP Information Collection
- Windows PowerShell Invoke-Sqlcmd Execution
- Windows PowerShell MSIX Package Installation
- Windows PowerShell ScheduleTask
- Windows PowerShell Script Block With Malicious String
- Windows PowerShell Script TabExpansion Direct Call
- Windows PowerShell WMI Win32 ScheduledJob
- Windows PowerSploit GPP Discovery
- Windows PowerView AD Access Control List Enumeration
- Windows PowerView Constrained Delegation Discovery
- Windows PowerView Kerberos Service Ticket Request
- Windows PowerView SPN Discovery
- Windows PowerView Unconstrained Delegation Discovery
- Windows Powershell Commands from DNS TXT
- Windows Powershell Cryptography Namespace
- Windows Powershell History File Deletion
- Windows Powershell Import Applocker Policy
- Windows Powershell Logoff User via Quser
- Windows Root Domain linked policies Discovery
- Windows Screen Capture Via Powershell
- Windows Software Discovery Via PowerShell
- Windows WinPEAS PowerShell Script Execution
Sigma 181
- AADInternals PowerShell Cmdlets Execution - PsScript by Austin Songer (@austinsonger), Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
- AD Groups Or Users Enumeration Using PowerShell - ScriptBlock by frack113
- AMSI Bypass Pattern Assembly GetType by Florian Roth (Nextron Systems)
- Abuse of Service Permissions to Hide Services Via Set-Service - PS by Nasreddine Bencherchali (Nextron Systems)
- Access to Browser Login Data by frack113
- Active Directory Computers Enumeration With Get-AdComputer by frack113
- Active Directory Group Enumeration With Get-AdGroup by frack113
- Add Windows Capability Via PowerShell Script by Nasreddine Bencherchali (Nextron Systems)
- Automated Collection Bookmarks Using Get-ChildItem PowerShell by frack113
- Automated Collection Command PowerShell by frack113
- Certificate Exported Via PowerShell - ScriptBlock by Florian Roth (Nextron Systems)
- Change PowerShell Policies to an Insecure Level - PowerShell by frack113
- Change User Agents with WebRequest by frack113
- Clear PowerShell History - PowerShell by Ilyas Ochkov, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community
- Clearing Windows Console History by Austin Songer @austinsonger
- Code Executed Via Office Add-in XLL File by frack113
- Compress-Archive Cmdlet Execution by Timur Zinniatullin, oscd.community
- Computer Discovery And Export Via Get-ADComputer Cmdlet - PowerShell by Nasreddine Bencherchali (Nextron Systems)
- Create Volume Shadow Copy with Powershell by frack113
- DMSA Link Attributes Modified by Swachchhanda Shrawan Poudel (Nextron Systems)
- DMSA Service Account Created in Specific OUs - PowerShell by Swachchhanda Shrawan Poudel (Nextron Systems)
- DSInternals Suspicious PowerShell Cmdlets - ScriptBlock by Nasreddine Bencherchali (Nextron Systems)
- Deletion of Volume Shadow Copies via WMI with PowerShell - PS Script by Tim Rauch, frack113
- Detected Windows Software Discovery - PowerShell by Nikita Nazarov, oscd.community
- DirectorySearcher Powershell Exploitation by frack113
- Disable Powershell Command History by Ali Alwashali
- Disable of ETW Trace - Powershell by Nasreddine Bencherchali (Nextron Systems)
- Disable-WindowsOptionalFeature Command PowerShell by frack113
- Dump Credentials from Windows Credential Manager With PowerShell by frack113
- Enable Windows Remote Management by frack113
- Enumerate Credentials from Windows Credential Manager With PowerShell by frack113
- Execute Invoke-command on Remote Host by frack113
- Extracting Information with PowerShell by frack113
- Get-ADUser Enumeration Using UserAccountControl Flags by frack113
- HackTool - Defendnot Installation via PowerShell One-Liner by Swachchhanda Shrawan Poudel (Nextron Systems)
- HackTool - Rubeus Execution - ScriptBlock by Christian Burkard (Nextron Systems), Florian Roth (Nextron Systems)
- HackTool - WinPwn Execution - ScriptBlock by Swachchhanda Shrawan Poudel
- Import PowerShell Modules From Suspicious Directories by Nasreddine Bencherchali (Nextron Systems)
- Inbox Rules Creation Or Update Activity Via ExchangePowerShell Cmdlet by Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
- Invoke-Obfuscation CLIP+ Launcher - PowerShell by Jonathan Cheong, oscd.community
- Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell by Timur Zinniatullin, oscd.community
- Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell by Daniel Bohannon (@Mandiant/@FireEye), oscd.community
- Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell by Timur Zinniatullin, oscd.community
- Invoke-Obfuscation STDIN+ Launcher - Powershell by Jonathan Cheong, oscd.community
- Invoke-Obfuscation VAR+ Launcher - PowerShell by Jonathan Cheong, oscd.community
- Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell by Timur Zinniatullin, oscd.community
- Invoke-Obfuscation Via Stdin - Powershell by Nikita Nazarov, oscd.community
- Invoke-Obfuscation Via Use Clip - Powershell by Nikita Nazarov, oscd.community
- Invoke-Obfuscation Via Use MSHTA - PowerShell by Nikita Nazarov, oscd.community
- Invoke-Obfuscation Via Use Rundll32 - PowerShell by Nikita Nazarov, oscd.community
- Lace Tempest PowerShell Evidence Eraser by Nasreddine Bencherchali (Nextron Systems)
- Lace Tempest PowerShell Launcher by Nasreddine Bencherchali (Nextron Systems)
- Live Memory Dump Using Powershell by Max Altgelt (Nextron Systems)
- Mail Forwarding/Redirecting Activity Via ExchangePowerShell Cmdlet by Nasreddine Bencherchali (Nextron Systems), Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
- Malicious Nishang PowerShell Commandlets by Alec Costello
- Malicious PowerShell Commandlets - ScriptBlock by Sean Metcalf, Florian Roth, Bartlomiej Czyz @bczyz1, oscd.community, Nasreddine Bencherchali, Tim Shelton, Mustafa Kaan Demir, Georg Lauenstein, Max Altgelt, Tobias Michalski, Austin Songer
- Malicious PowerShell Keywords by Sean Metcalf (source), Florian Roth (Nextron Systems)
- Malicious ShellIntel PowerShell Commandlets by Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems)
- Manipulation of User Computer or Group Security Principals Across AD by frack113
- Modify Group Policy Settings - ScriptBlockLogging by frack113
- NTFS Alternate Data Stream by Sami Ruohonen
- New User Account Creation Attempt Via ADSI by William Gokah (idea), Raylee Hawkins, Swachchhanda Shrawan Poudel (Nextron Systems)
- New Windows Firewall Rule Added Via New-NetFirewallRule Cmdlet - ScriptBlock by frack113
- PSAsyncShell - Asynchronous TCP Reverse Shell by Nasreddine Bencherchali (Nextron Systems)
- Password Policy Discovery With Get-AdDefaultDomainPasswordPolicy by frack113
- Potential AMSI Bypass Script Using NULL Bits by Nasreddine Bencherchali (Nextron Systems)
- Potential APT FIN7 POWERHOLD Execution by Nasreddine Bencherchali (Nextron Systems)
- Potential Active Directory Enumeration Using AD Module - PsScript by frack113, Nasreddine Bencherchali
- Potential COM Objects Download Cradles Usage - PS Script by frack113
- Potential Data Exfiltration Over SMTP Via Send-MailMessage Cmdlet by frack113
- Potential Data Exfiltration Via Audio File by Nasreddine Bencherchali (Nextron Systems)
- Potential In-Memory Execution Using Reflection.Assembly by frack113
- Potential Invoke-Mimikatz PowerShell Script by Tim Rauch, Elastic (idea)
- Potential Keylogger Activity by Nasreddine Bencherchali (Nextron Systems)
- Potential POWERTRASH Script Execution by Nasreddine Bencherchali (Nextron Systems)
- Potential Packet Capture Activity Via Start-NetEventSession - ScriptBlock by frack113
- Potential Persistence Via PowerShell User Profile Using Add-Content by frack113, Nasreddine Bencherchali (Nextron Systems)
- Potential Persistence Via Security Descriptors - ScriptBlock by Nasreddine Bencherchali (Nextron Systems)
- Potential PowerShell Obfuscation Using Alias Cmdlets by frack113
- Potential PowerShell Obfuscation Using Character Join by Nasreddine Bencherchali (Nextron Systems)
- Potential Registry Reconnaissance Via PowerShell Script by frack113
- Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell ScriptBlock by Nasreddine Bencherchali (Nextron Systems)
- Potential Suspicious PowerShell Keywords by Florian Roth (Nextron Systems), Perez Diego (@darkquassar), Tuan Le (NCSGroup)
- Potential Suspicious Windows Feature Enabled by frack113
- Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock by frack113
- Potential WinAPI Calls Via PowerShell Scripts by Nasreddine Bencherchali (Nextron Systems), Nikita Nazarov, oscd.community
- Potentially Suspicious Call To Win32_NTEventlogFile Class - PSScript by Nasreddine Bencherchali (Nextron Systems)
- PowerShell ADRecon Execution by Bhabesh Raj
- PowerShell Create Local User by @ROxPinTeddy
- PowerShell Credential Prompt by John Lambert (idea), Florian Roth (Nextron Systems)
- PowerShell Deleted Mounted Share by oscd.community, @redcanary, Zach Stanford @svch0st
- PowerShell Dynamic Module Invocation Via ExportedCommands Array Index - PS Script by Norbert Jaśniewicz (AlphaSOC)
- PowerShell Get-Process LSASS in ScriptBlock by Florian Roth (Nextron Systems)
- PowerShell Hotfix Enumeration by Nasreddine Bencherchali (Nextron Systems)
- PowerShell ICMP Exfiltration by Bartlomiej Czyz @bczyz1, oscd.community
- PowerShell PSAttack by Sean Metcalf (source), Florian Roth (Nextron Systems)
- PowerShell Remote Session Creation by frack113
- PowerShell Script Change Permission Via Set-Acl - PsScript by frack113, Nasreddine Bencherchali (Nextron Systems)
- PowerShell Script With File Hostname Resolving Capabilities by Nasreddine Bencherchali (Nextron Systems)
- PowerShell Script With File Upload Capabilities by frack113
- PowerShell Set-Acl On Windows Folder - PsScript by frack113, Nasreddine Bencherchali (Nextron Systems)
- PowerShell ShellCode by David Ledbetter (shellcode), Florian Roth (Nextron Systems)
- PowerShell WMI Win32_Product Install MSI by frack113
- PowerShell Web Access Installation - PsScript by Michael Haag
- PowerShell Write-EventLog Usage by Nasreddine Bencherchali (Nextron Systems)
- PowerView PowerShell Cmdlets - ScriptBlock by Bhabesh Raj
- Powershell Add Name Resolution Policy Table Rule by Borna Talebi
- Powershell Create Scheduled Task by frack113
- Powershell DNSExfiltration by frack113
- Powershell Detect Virtualization Environment by frack113, Duc.Le-GTSC
- Powershell Directory Enumeration by frack113
- Powershell Execute Batch Script by frack113
- Powershell Install a DLL in System Directory by frack113, Nasreddine Bencherchali (Nextron Systems)
- Powershell Keylogging by frack113
- Powershell Local Email Collection by frack113
- Powershell LocalAccount Manipulation by frack113
- Powershell MsXml COM Object by frack113, MatilJ
- Powershell Sensitive File Discovery by frack113
- Powershell Store File In Alternate Data Stream by frack113
- Powershell Suspicious Win32_PnPEntity by frack113
- Powershell Timestomp by frack113
- Powershell Token Obfuscation - Powershell by frack113
- Powershell WMI Persistence by frack113
- Powershell XML Execute Command by frack113
- Recon Information for Export with PowerShell by frack113
- Registry Modification Attempt Via VBScript - PowerShell by Swachchhanda Shrawan Poudel (Nextron Systems)
- Registry-Free Process Scope COR_PROFILER by frack113
- Remove Account From Domain Admin Group by frack113
- Replace Desktop Wallpaper by Powershell by frack113
- Root Certificate Installed - PowerShell by oscd.community, @redcanary, Zach Stanford @svch0st
- SMB over QUIC Via PowerShell Script by frack113
- Security Software Discovery Via Powershell Script by frack113, Anish Bogati, Nasreddine Bencherchali (Nextron Systems)
- Service Registry Permissions Weakness Check by frack113
- Silence.EDA Detection by Alina Stepchenkova, Group-IB, oscd.community
- Suspicious Connection to Remote Account by frack113
- Suspicious Eventlog Clear by Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
- Suspicious FromBase64String Usage On Gzip Archive - Ps Script by frack113
- Suspicious GPO Discovery With Get-GPO by frack113
- Suspicious Get Information for SMB Share by frack113
- Suspicious Get Local Groups Information - PowerShell by frack113
- Suspicious Get-ADReplAccount by frack113
- Suspicious GetTypeFromCLSID ShellExecute by frack113
- Suspicious Hyper-V Cmdlets by frack113
- Suspicious IO.FileStream by frack113
- Suspicious Invoke-Item From Mount-DiskImage by frack113
- Suspicious Kerberos Ticket Request via PowerShell Script - ScriptBlock by frack113
- Suspicious Mount-DiskImage by frack113
- Suspicious New-PSDrive to Admin Share by frack113
- Suspicious PowerShell Download - Powershell Script by Florian Roth (Nextron Systems)
- Suspicious PowerShell Get Current User by frack113
- Suspicious PowerShell Invocations - Generic by Florian Roth (Nextron Systems)
- Suspicious PowerShell Invocations - Specific by Florian Roth (Nextron Systems), Jonhnathan Ribeiro
- Suspicious PowerShell Mailbox Export to Share - PS by Nasreddine Bencherchali (Nextron Systems)
- Suspicious PowerShell WindowStyle Option by frack113, Tim Shelton (fp AWS)
- Suspicious Process Discovery With Get-Process by frack113
- Suspicious SSL Connection by frack113
- Suspicious Service DACL Modification Via Set-Service Cmdlet - PS by Nasreddine Bencherchali (Nextron Systems)
- Suspicious Start-Process PassThru by frack113
- Suspicious TCP Tunnel Via PowerShell Script by Nasreddine Bencherchali (Nextron Systems)
- Suspicious Unblock-File by frack113
- Suspicious X509Enrollment - Ps Script by frack113
- SyncAppvPublishingServer Execution to Bypass Powershell Restriction by Ensar Şamil, @sblmsrsn, OSCD Community
- Tamper Windows Defender - ScriptBlockLogging by frack113, elhoim, Tim Shelton (fps, alias support), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)
- Tamper Windows Defender Remove-MpPreference - ScriptBlockLogging by Nasreddine Bencherchali (Nextron Systems)
- Testing Usage of Uncommonly Used Port by frack113
- Troubleshooting Pack Cmdlet Execution by Nasreddine Bencherchali (Nextron Systems)
- Unsigned AppX Installation Attempt Using Add-AppxPackage - PsScript by Nasreddine Bencherchali (Nextron Systems)
- Usage Of Web Request Commands And Cmdlets - ScriptBlock by James Pemberton / @4A616D6573
- Use Of Remove-Item to Delete File - ScriptBlock by frack113
- User Discovery And Export Via Get-ADUser Cmdlet - PowerShell by Nasreddine Bencherchali (Nextron Systems)
- Veeam Backup Servers Credential Dumping Script Execution by Nasreddine Bencherchali (Nextron Systems)
- WMIC Unquoted Services Path Lookup - PowerShell by Nasreddine Bencherchali (Nextron Systems)
- WMImplant Hack Tool by NVISO
- WinAPI Function Calls Via PowerShell Scripts by Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems)
- WinAPI Library Calls Via PowerShell Scripts by Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems)
- Windows Defender Exclusions Added - PowerShell by Tim Rauch, Elastic (idea)
- Windows Firewall Profile Disabled by Austin Songer @austinsonger
- Windows Mail App Mailbox Access Via PowerShell Script by frack113
- Windows Screen Capture with CopyFromScreen by frack113
- Winlogon Helper DLL by Timur Zinniatullin, oscd.community
- Zip A Folder With PowerShell For Staging In Temp - PowerShell Script by Nasreddine Bencherchali (Nextron Systems), frack113
Elastic 14
- Dynamic IEX Reconstruction via Method String Access
- Potential AMSI Bypass via RPC Runtime Hooking
- Potential Dynamic IEX Reconstruction via Environment Variables
- Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion
- Potential PowerShell Obfuscation via Character Array Reconstruction
- Potential PowerShell Obfuscation via Concatenated Dynamic Command Invocation
- Potential PowerShell Obfuscation via High Numeric Character Proportion
- Potential PowerShell Obfuscation via High Special Character Proportion
- Potential PowerShell Obfuscation via Invalid Escape Sequences
- Potential PowerShell Obfuscation via Reverse Keywords
- Potential PowerShell Obfuscation via Special Character Overuse
- Potential PowerShell Obfuscation via String Concatenation
- Potential PowerShell Obfuscation via String Reordering
- PowerShell Obfuscation via Negative Index String Reversal
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| OMB M-26-14: Attack vectors and lateral movementAppendix B item 5(10) | Supports an activity | our analysis: remoting and script content |
| ASD ACSC / CISA et al.: PowerShell loggingBest Practices for Event Logging and Threat Detection (Aug 2024) | Names this event | quoted: script block logging |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 11 V2R11 (2026-10-05) | Names this event | WN11-CC-000326 (workstation): PowerShell Script Block Logging Policy |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2022 V2R11 | Names this event | WN22-CC-000460 (server): PowerShell Script Block Logging Policy |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 10 V3R6 (2026-01-23) | Names this event | WN10-CC-000326 (workstation): PowerShell Script Block Logging Policy |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2019 V3R9 (2026-07-10) | Names this event | WN19-CC-000460 (server): PowerShell Script Block Logging Policy |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2025 V1R1 (2026-02-27) | Names this event | WN25-CC-000460 (server): PowerShell Script Block Logging Policy |
| NSA: Recommended Windows events to forwardEvent Forwarding Guidance (RecommendedEvents.csv) | Names this event | PowerShell Activities: Exception Raised |
EDR events that stand in for it
Full: the sensor event carries what this event carries. Partial: the sensor reports a subset, so it does not replace the event.
| Product | Sensor event | Fidelity | Basis |
|---|---|---|---|
| CrowdStrike Falcon sensor telemetry (FDR event_simpleName) | ScriptControlScanTelemetry | Partial | pySigma-backend-crowdstrike: ps_script -> CommandHistory, ScriptControlScanTelemetry; only AMSI-scanned content and interactive command history, not every script block |
| CrowdStrike Falcon sensor telemetry (FDR event_simpleName) | CommandHistory | Partial | pySigma-backend-crowdstrike: ps_script -> CommandHistory, ScriptControlScanTelemetry; only AMSI-scanned content and interactive command history, not every script block |
| Microsoft Defender for Endpoint device tables | DeviceEvents | Partial | our analysis: PowerShellCommand ActionType (command names only) and AmsiScriptContent (scanned content) in DeviceEvents, both named in Sentinel rules; script block text is not reproduced in full |