ScriptBlock Smuggling

What it is

A hands-on forensic test of BC-Security's ScriptBlock Smuggling technique on a lab configured with all three PowerShell logging modes (Script Block, Module, Transcript). The value beyond the summary is the concrete detection finding and the reproducible test harness — this post is about what survives in the logs, not the offensive technique itself (it defers to BC-Security's original post for that).

How it works

The technique builds a ScriptBlockAst by hand, splicing the extent (source text) from a benign spoof block together with the end block from a separate malicious block:

$SpoofedAst  = [ScriptBlock]::Create("Write-Output 'Nothing to see here :)'").Ast
$ExecutedAst = [ScriptBlock]::Create("Invoke-WebRequest 'https://dfir.ch/favicon.ico' -OutFile 'C:\Users\Public\favicon.ico'").Ast
$Ast = [System.Management.Automation.Language.ScriptBlockAst]::new($SpoofedAst.Extent,
  $null, $null, $null,
  $ExecutedAst.EndBlock.Copy(),
  $null)
$Sb = $Ast.GetScriptBlock()
$Sb.Invoke()

Event 4104 (Script Block Logging) records the spoof extent; the constructor's fifth argument (the copied end block) is what actually executes. No reflection or memory patching is needed, and AMSI is bypassed.

What to do

• Enable PowerShell Module Logging (Event 4103), not just Script Block Logging. In the author's lab, module logging captured the real executed cmdlets even though 4104 showed only the spoofed text. Set the logged-modules list to * to log everything in a session.
• Reference given for configuration: "Configure PowerShell logging from Splunk."
• An AtomicRedTeam test now exists for this (name: ScriptBlock Smuggling), with spoofed_command / executed_command input arguments — use it to validate that your 4103 pipeline surfaces the executed command.
• Treat 4103 as the fallback detection source but expect it to be harder to parse than 4104 from a monitoring standpoint.

Caveats

• The author (and X user SerkinValery) questions how useful the technique actually is: the entire cover-up/spoof script is still fully captured in 4104, so it hides the malicious payload but not the fact that suspicious splicing occurred — and 4103 defeats the concealment regardless.
• Findings are from the author's own lab reproduction, not a formal study.
• The real-world attacker sample shown ("Play along" gist, posted by Nasreddine) is truncated and uses string-concatenation and Base64 obfuscation alongside the AST trick — indicating the technique appears combined with other evasion in the wild, not in isolation.