// REFERENCE
4104 — PowerShell script block logging
Log: PowerShell/Operational
High risk
Logs the full script block PowerShell is about to run, already de-obfuscated (Operational log). It's the best visibility into malicious PowerShell: it reveals IEX, downloads, decoded Base64 strings and payloads. Hunt by keywords in the ScriptBlockText.
Related tools
Work with this in:
Related
400
400 — PowerShell engine started 800
800 — PowerShell pipeline execution details 4103
4103 — PowerShell module logging
400 — PowerShell engine started 800
800 — PowerShell pipeline execution details 4103
4103 — PowerShell module logging
Original descriptions based on Microsoft's public documentation. IDs and fields may vary with the Windows version and the active audit policy.