win:powershell 4105
Script block invocation started
Microsoft-Windows-PowerShell/Operational: a script block began executing (invocation logging).
- Log source
- PowerShell logging
- Host type
- Windows (workstation, member server, domain controller)
- How to enable
- Script Block Invocation Logging, in addition to script block logging; high volume.
- Tier, host type
- Minimum
- Techniques
- 56
- Rules depending on it
- none
Why this tier
NSA
By role
| Role | Tier | Basis |
|---|---|---|
| Windows workstation | Minimum | NSA |
| Windows member server | Minimum | NSA |
| Windows domain controller | Minimum | NSA |
| Windows web server (IIS), internet-facing | Minimum | NSA |
Techniques it helps detect
- T1007 System Service Discovery
- T1010 Application Window Discovery
- T1012 Query Registry
- T1016 System Network Configuration Discovery
- T1016.001 Internet Connection Discovery
- T1016.002 Wi-Fi Discovery
- T1027.018 Invisible Unicode
- T1033 System Owner/User Discovery
- T1036.001 Invalid Code Signature
- T1036.002 Right-to-Left Override
- T1049 System Network Connections Discovery
- T1056.002 GUI Input Capture
- T1059.001 PowerShell
- T1069 Permission Groups Discovery
- T1069.002 Domain Groups
- T1070.003 Clear Command History
- T1070.004 File Deletion
- T1070.005 Network Share Connection Removal
- T1070.008 Clear Mailbox Data
- T1082 System Information Discovery
- T1087.002 Domain Account
- T1087.003 Email Account
- T1114 Email Collection
- T1114.002 Remote Email Collection
- T1114.003 Email Forwarding Rule
- T1124 System Time Discovery
- T1132.001 Standard Encoding
- T1132.002 Non-Standard Encoding
- T1135 Network Share Discovery
- T1197 BITS Jobs
- T1201 Password Policy Discovery
- T1204.004 Malicious Copy and Paste
- T1205 Traffic Signaling
- T1216 System Script Proxy Execution
- T1216.001 PubPrn
- T1216.002 SyncAppvPublishingServer
- T1217 Browser Information Discovery
- T1218.003 CMSTP
- T1218.004 InstallUtil
- T1218.009 Regsvcs/Regasm
- T1218.013 Mavinject
- T1218.014 MMC
- T1222 File and Directory Permissions Modification
- T1222.001 Windows Permissions
- T1480 Execution Guardrails
- T1480.001 Environmental Keying
- T1505.002 Transport Agent
- T1534 Internal Spearphishing
- T1556.005 Reversible Encryption
- T1564.008 Email Hiding Rules
- T1564.011 Ignore Process Interrupts
- T1615 Group Policy Discovery
- T1674 Input Injection
- T1679 Selective Exclusion
- T1690 Prevent Command History Logging
- T1700 AI-Enabled Exfiltration
Rules that depend on it
No vendor rule names this event or source directly.
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| NSA: Recommended Windows events to forwardEvent Forwarding Guidance (RecommendedEvents.csv) | Names this event | PowerShell Activities: Exception Raised |