Skip to content

1 entry

PowerShell

Script block logging and what PowerShell records about the code it runs.

4104 PowerShell Event 4104: Script block logging Worth a look PowerShell recorded the actual code it was about to run. Because it logs the script after decoding and de-obfuscation, it defeats encoded commands entirely — which makes it the single most valuable thing you can enable for detecting PowerShell abuse.