Event ID 4104 is a PowerShell Operational event that records script block content when Script Block Logging is enabled. It gives defenders visibility into the commands PowerShell processes in new sessions. Enable the policy and monitor script content for obfuscation, download activity, credential access and suspicious administrative action.
What Event ID 4104 Shows About PowerShell Activity
Event ID 4104 is valuable because it exposes the script text PowerShell is asked to run, not just that PowerShell started. That makes it one of the clearest Windows telemetry sources for understanding what an interactive or automated session actually tried to do.
When Script Block Logging is enabled, the event can reveal encoded commands, obfuscation patterns, staged downloaders, and administrative commands that would otherwise blend into normal PowerShell usage. For defenders, the practical value is that the event turns PowerShell into readable security evidence rather than a black box.
Why Script Block Logging Matters
PowerShell is powerful precisely because it can automate administration, remote execution, and system changes. That flexibility also makes it attractive for abuse, because legitimate-looking commands can carry payloads, enumerate systems, or fetch additional tools with little surface noise.
Script Block Logging is designed to preserve the content of those scripts at execution time. It is especially useful when commands are heavily obfuscated, broken into multiple lines, or generated dynamically, because the logged script block can be more informative than process creation alone.
For coverage to be meaningful, organisations should treat Event ID 4104 as part of a wider Windows logging strategy, not a standalone control. NHIMG’s Windows Event Log Guide is a useful companion for placing this event within the broader audit and event ID landscape.
What Analysts Look For In 4104 Data
Defenders usually read 4104 content for indicators of tradecraft rather than for single suspicious strings. Repeated use of encoded commands, string concatenation, download cradles, in-memory execution patterns, and calls to credential-related cmdlets can all indicate that the script is doing more than ordinary administration.
Event 4104 is also helpful when an investigation needs to establish intent. If a suspicious session used PowerShell, the script block can show whether the activity was routine automation, a failed administrative action, or a clear attempt to evade controls.
The value is highest when the event is forwarded centrally and correlated with process creation, logon activity, and parent-child execution chains. NHIMG’s Sysmon Guide is useful here because Sysmon often supplies the complementary process and network context that helps interpret script block content.
How To Use It In Detection And Investigation
Event ID 4104 works best as both a detection source and a forensic aid. In detection, it can support rules for suspicious PowerShell patterns, unusual administrative activity, and known attacker behaviours that rely on script-based execution. In investigation, it helps analysts reconstruct what the host actually executed when the initial alert only showed PowerShell activity.
It also matters for post-incident review. If a session is later judged malicious, 4104 can help determine whether the script touched credentials, attempted lateral movement, downloaded tooling, or altered security settings. That makes it useful not only for spotting the initial event, but also for understanding what exposure followed.
For command and technique mapping, NHIMG’s PowerShell Security Guide provides the broader abuse patterns that often appear inside script block logs.
Risk and Threat Considerations
Event ID 4104 can expose highly sensitive script content, but only if Script Block Logging is enabled and logs are collected reliably. If logging is absent, incomplete, or not monitored, attackers can use PowerShell as an execution layer while leaving defenders with far less visibility into the real command content.
Failure mechanism: Obfuscated PowerShell, encoded payloads, download-and-execute activity, and credential access attempts can all be concealed when organisations rely only on process names or miss the script block record itself.
Impact: Reduced visibility can delay detection of malware staging, administrative abuse, and post-compromise actions, while making investigations harder because analysts lose the most readable record of what PowerShell actually did.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1059.001 — PowerShell | Event ID 4104 records PowerShell script content used in ATT&CK execution tradecraft. |
| Recommendation — Map suspicious script blocks to PowerShell tradecraft and hunt for follow-on execution patterns. | ||
| NIST SP 800-53 Rev 5 | AU-12 — Audit Record Generation | 4104 depends on generating audit records for script block execution. |
| AU-6 — Audit Review, Analysis, and Reporting | The event is valuable only when analysts review and correlate the logged script content. | |
| SI-4 — System Monitoring | 4104 supports monitoring for suspicious PowerShell activity on endpoints and servers. | |
| Recommendation — Enable and retain the audit records needed to capture PowerShell script blocks. Review 4104 logs for suspicious commands, obfuscation, and credential access indicators. Correlate script block logs with endpoint monitoring to detect malicious PowerShell activity. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Script block logging is an audit logging use case for Windows telemetry. |
| CIS-13 — Network Monitoring and Defense | PowerShell abuse often pairs script content with staged downloads or remote activity. | |
| Recommendation — Centralise and retain PowerShell script logs so defenders can investigate abuse. Correlate PowerShell logs with network telemetry to spot staged payload retrieval. | ||
Practitioner Guidance
Why practitioners should care: Treat Event ID 4104 as high-value investigative telemetry, not generic noise. The event is most useful when it is enabled, centralised, and reviewed alongside other host and authentication logs so the script content can be interpreted in context.
What to watch for: Focus on obfuscation, unusual download behaviour, suspicious administrative command chains, and script content that does not fit the host’s normal automation profile. Those patterns often matter more than any single keyword match.
Practitioner takeaway: The control only pays off when the log is both collected and searched, because the security value is in the script content itself.