PowerShell 4104 — Script block logging
PowerShell 4104 — Script block logging. PowerShell logs script-block text with an identifier and multipart sequence fields.
Source and collection
Windows PowerShell: Microsoft-Windows-PowerShell/Operational. PowerShell 7 uses PowerShellCore/Operational after registration.
Enable the corresponding module or script-block logging policy for the target edition. Read with Get-WinEvent; protect potentially sensitive script content.
Native example and provenance
upstream test fixture. Published example; no independent capture provenance claimed.
Original publisher / pinned upstream fixture — events[3].event.original
Decoded event.original string; retained the complete Event XML element, excluding any appended rendered message; native XML values unchanged.
Pinned source commit: 9ae756f00f82786ac3496ce99c2dd288c5a5c031
Download the exact sample · Offline research kit
SHA-256: fd4aedcb9af1e770f9b93aaba3552fa64f96ed572d4af8e10c9716024123ec18
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-PowerShell' Guid='{a0c1853b-5c40-4b15-8766-3cf1c58f985a}'/><EventID>4104</EventID><Version>1</Version><Level>5</Level><Task>2</Task><Opcode>15</Opcode><Keywords>0x0</Keywords><TimeCreated SystemTime='2020-05-14T11:33:51.389266200Z'/><EventRecordID>3580</EventRecordID><Correlation ActivityID='{fb13c9de-29f7-0001-18e0-13fbf729d601}'/><Execution ProcessID='4844' ThreadID='4428'/><Channel>Microsoft-Windows-PowerShell/Operational</Channel><Computer>vagrant</Computer><Security UserID='S-1-5-21-1350058589-2282154016-2764056528-1000'/></System><EventData><Data Name='MessageNumber'>1</Data><Data Name='MessageTotal'>1</Data><Data Name='ScriptBlockText'>.\patata.ps1</Data><Data Name='ScriptBlockId'>50d2dbda-7361-4926-a94d-d9eadfdb43fa</Data><Data Name='Path'></Data></EventData></Event>
Structure and field interpretation
| Field/path | Serialized type |
|---|---|
Microsoft-Windows-PowerShell | XML text |
EventID | XML text |
Version | XML text |
Level | XML text |
Task | XML text |
Opcode | XML text |
Keywords | XML text |
TimeCreated | XML text |
EventRecordID | XML text |
Correlation | XML text |
Execution | XML text |
Channel | XML text |
Computer | XML text |
Security | XML text |
MessageNumber | XML text |
MessageTotal | XML text |
ScriptBlockText | XML text |
ScriptBlockId | XML text |
Path | XML text |
- EventID
- 4104
- ContextInfo
- Pipeline/module context where present.
- ScriptBlockText
- Script text in event 4104; can include secrets.
- ScriptBlockId
- Script-block correlation value, not a process identifier.
Investigation uses
- Review suspicious automation with process, user and host context.
- For script blocks, reconstruct MessageNumber / MessageTotal parts by ScriptBlockId and preserve ordering.
Validation boundaries
Logging and automatic suspicious-script behavior differ by version; script text is not proof every command completed.
This sample passed byte-integrity and JSON/XML parsing checks, including the catalogue’s specified event discriminators. This is not a complete vendor-schema validation or a tested detection.
For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.
Related sources
Ecosystem connections
References
Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.