| name | analyzing-powershell-script-block-logging |
| description | Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files to detect obfuscated commands, encoded payloads, and living-off-the-land techniques. Uses python-evtx to extract and reconstruct multi-block scripts, applies entropy analysis and pattern matching for Base64-encoded commands, Invoke-Expression abuse, download cradles, and AMSI bypass attempts. |
| domain | cybersecurity |
| subdomain | security-operations |
| tags | ["analyzing","powershell","script","block"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
Instructions
- Install dependencies:
pip install python-evtx lxml
- Collect PowerShell Operational logs:
Microsoft-Windows-PowerShell%4Operational.evtx
- Parse Event ID 4104 entries using python-evtx to extract ScriptBlockText, ScriptBlockId, and MessageNumber/MessageTotal for multi-part script reconstruction.
- Apply detection heuristics:
- Base64-encoded commands (
-EncodedCommand, FromBase64String)
- Download cradles (
DownloadString, DownloadFile, Invoke-WebRequest, Net.WebClient)
- AMSI bypass patterns (
AmsiUtils, amsiInitFailed)
- Obfuscation indicators (high entropy, tick-mark insertion, string concatenation)
- Generate a report with reconstructed scripts, risk scores, and MITRE ATT&CK mappings.
python scripts/agent.py --evtx-file /path/to/PowerShell-Operational.evtx --output ps_analysis.json
Examples
Detect Encoded Command Execution
import base64
if "-encodedcommand" in script_text.lower():
encoded = script_text.split()[-1]
decoded = base64.b64decode(encoded).decode("utf-16-le")
Reconstruct Multi-Block Script
Scripts split across multiple 4104 events share a ScriptBlockId. Concatenate blocks ordered by MessageNumber to recover the full script.
