Lion Cipher Lab
Detect malicious PowerShell with Script Block Logging (Event ID 4104)
- SOC Analyst / Blue Team
- Intermediate
- ~45 min
- Free · no account required
Why it matters
PowerShell is the attacker's favourite tool on Windows because it is already installed, trusted, and endlessly flexible — and because attackers hide what it does. They base64-encode the command with -EncodedCommand, they build the real payload out of string fragments and hand it to Invoke-Expression (IEX), they pull code off the internet with a DownloadString cradle so nothing malicious ever touches disk. Process-command-line logging (Security log Event ID 4688, or Sysmon Event ID 1) only ever sees the OUTER command line — literally 'powershell.exe -EncodedCommand SQBFAFgA...' — a wall of…
What you'll learn
- enabling PowerShell Script Block Logging via Group Policy (gpedit.msc) AND via the registry so it works on Windows Home
- knowing the exact registry path/value: HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\EnableScriptBlockLogging = 1
- where the events land: the Microsoft-Windows-PowerShell/Operational log, Event ID 4104 (script block text), plus 4103/4105/4106
- reading a 4104 record in Event Viewer and querying it with Get-WinEvent -FilterHashtable
- proving that 4104 records the DECODED, reconstructed script even when the attacker used -EncodedCommand or an obfuscated IEX one-liner
- writing a detection filter that flags suspicious script blocks (FromBase64String, IEX, DownloadString, -enc) and shaping it into a SIEM rule
- the judgment: why 4104 beats process-command-line-only logging, when it gets noisy, and how it pairs with Sysmon and AMSI
Steps in this lab
- The one idea: 4104 logs the script AS RUN, after it is decoded
- When 4104 beats command-line logging — and when it gets loud
- Turn it on the Home-friendly way: the registry value
- The same switch in Group Policy (Pro/Enterprise), and its noisier siblings
- Run benign PowerShell that is SHAPED like the real attacks
- Hunt the 4104 records — Event Viewer first, then Get-WinEvent
- The payoff: watch 4104 defeat the -EncodedCommand obfuscation
- Turn it into a detection: flag the suspicious script blocks
- The pro posture: 4104 plus AMSI plus Sysmon, and clean up