PowerShell Script Block Logging

Named by 2 kept items in this workspace.

Search every workspace for PowerShell Script Block Logging. It matches the name as written, so it can find other things that share it.

The items that name it 2

Field Notes: Reconstructing an Attacker’s Workflow
writeup2026-10-22It is written here as PowerShell Script Block Logging (Event ID 4104): preserves executed PowerShell code, including dynamically generated or decoded script blocks.
Event ID 4104
OAuth Token Theft Through Microsoft's Front Door | Huntress
writeup2026-09-23It is written here as PowerShell Script Block Logging (Event ID 4104).
Captures the AppX manifest content during registration for detection

All technologies in this workspace.