analyzing-powershell-script-block-logging

name	analyzing-powershell-script-block-logging
description	Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files to detect obfuscated commands, encoded payloads, and living-off-the-land techniques. Uses python-evtx to extract and reconstruct multi-block scripts, applies entropy analysis and pattern matching for Base64-encoded commands, Invoke-Expression abuse, download cradles, and AMSI bypass attempts.
domain	cybersecurity
subdomain	security-operations
tags	["powershell","script-block-logging","event-id-4104","obfuscation-detection","windows-forensics","endpoint-security"]
version	1.0
author	mahipal
license