cyber.hendryadrian.com
Detection & Defense · socprime.com

How to Enable and Export PowerShell Script Block Logs

· Original article ↗

Summary

A guide to enabling and exporting PowerShell script block logs, including PowerShell 7’s separate channel. It covers log-volume and secret-exposure risks, plus what event 400 may reveal.

Key points

  • PowerShell script block logging records event 4104 in the Microsoft-Windows-PowerShell/Operational channel; enable the policy to capture a more complete record.
  • PowerShell 7 uses a separate PowerShellCore/Operational channel and policy key; ZIP installations may require registering the event manifest.
  • The guide provides Group Policy, registry, and wevtutil commands for enabling and exporting logs.
  • Logging does not recover past activity, and 5.1 may still produce Warning-level 4104 events for suspicious blocks when full logging is off.
  • Logs can grow quickly and may contain passwords or API keys in script text; raise the channel size and handle exported files carefully.
  • Event 400 in the classic Windows PowerShell log records engine starts; an EngineVersion of 2.0 on a modern system may indicate a downgrade intended to evade script block logging.
  • The LogTotal review section contains unfinished proof placeholders and warns that EVTX uploads are not yet sanitized.

Article Details

Defense Focus
Enable, preserve, export, and review PowerShell script block logs to detect suspicious or obfuscated PowerShell activity.
Detection Methods
  • Review Event 4104 script-block content; suspicious-block Warning events may appear even when full script block logging is disabled.
  • Inspect Event 400 engine-start records. An EngineVersion of 2.0 on a modern system may indicate a deliberate downgrade to evade script block logging.
  • Check the EnableScriptBlockLogging registry value and confirm the PowerShell 7 policy and event channel are configured.
  • Use PowerShell-log detection rules, including the rules attributed to Prime Core, to identify malicious PowerShell use, obfuscation, and download cradles.
Data Sources
  • Microsoft-Windows-PowerShell/Operational Event 4104
  • Windows PowerShell log Event 400
  • PowerShellCore/Operational event log
  • PowerShell script block logging policy registry keys
Rule Types
  • Windows Event Log XPath query filtering for EventID 4104
  • PowerShell-log detection rules; specific rule syntax is not stated
Defensive Actions
  • Enable script block logging through Group Policy or the EnableScriptBlockLogging registry value; this applies going forward and does not recover past events.
  • Increase the PowerShell event channel maximum size to retain more than a few hours of high-volume logs.
  • Export Event 4104 records and also collect the Windows PowerShell log, including Event 400 engine-start records.
  • For PowerShell 7 installed from a ZIP, run RegisterManifest.ps1 from $PSHOME if its event channel is not registered.
  • Treat EVTX files as potentially containing passwords or API keys; obtain data-handling approval before uploading production logs to LogTotal.
  • If Event 4104 text is encrypted by Protected Event Logging, use the decryption certificate.

MITRE ATT&CK

T1027 · Obfuscated Files or InformationThe article describes detecting obfuscated PowerShell code, whose later stages may be logged in readable form.T1059.001 · PowerShellThe article identifies malicious PowerShell use in script block logs as a detection focus.T1105 · Ingress Tool TransferThe article identifies download cradles that pull tools as behavior covered by PowerShell-log detection rules.

Products

LogTotalTry LogTotal, freePowerShellPowerShell script block logs live in Applications and Services Logs → Microsoft → Windows → PowerShell → Operational, as event 4104.PowerShell 7PowerShell 7 is a separate product with a separate channel, PowerShellCore/Operational, and its own policy setting.Prime CorePrime Core has 663 detection rules for PowerShell logs, mapped to 417 MITRE ATT&CK techniques.

Related Articles