Script block logging in PowerShell - Deep Dive

Overview - Script block logging

What is it?

Script block logging is a security feature in PowerShell that records the content of all script blocks executed on a system. A script block is a piece of PowerShell code, like a function or a command group. This logging helps track what scripts are running, making it easier to detect suspicious or harmful activity. It captures the actual code, not just the commands, providing detailed insight.

Why it matters

Without script block logging, malicious scripts can run unnoticed, making it hard to find and stop attacks. This feature helps system administrators and security teams see exactly what code was executed, improving threat detection and forensic analysis. It acts like a security camera for PowerShell scripts, helping protect computers from hidden dangers.

Where it fits

Before learning script block logging, you should understand basic PowerShell scripting and how PowerShell executes commands. After mastering this, you can explore advanced PowerShell security features like transcription logging and event log analysis. It fits into the broader topic of PowerShell security and system monitoring.

Mental Model

Core Idea

Script block logging captures every piece of PowerShell code run on a system to provide a detailed record for security and auditing.

Think of it like...

It's like having a security camera inside a kitchen that records every recipe a chef uses, not just the dishes served, so you know exactly what was cooked and how.

┌───────────────────────────────┐
│ PowerShell Script Execution    │
├──────────────┬────────────────┤
│ Script Block │ Logging Module  │
│ (Code Chunk) │ captures code  │
├──────────────┴────────────────┤
│ Logs stored in Windows Event   │
│ Logs for review and analysis   │
└───────────────────────────────┘

Build-Up - 7 Steps

1

Foundation

What is a Script Block in PowerShell

Concept: Understanding what a script block is in PowerShell.

A script block is a set of PowerShell commands or expressions enclosed in braces { }. It can be a simple command, a function, or a group of commands. For example: { Get-Process } is a script block that runs the Get-Process command. Script blocks are the basic units of code execution in PowerShell.

Result

You can identify and write script blocks as chunks of code inside braces.

Knowing what a script block is helps you understand what exactly script block logging records.

2

Foundation

How PowerShell Executes Script Blocks

Concept: PowerShell runs script blocks as executable code units.

When you run PowerShell commands or scripts, PowerShell breaks them into script blocks and executes them. For example, a function or a pipeline is a script block. This execution model allows PowerShell to manage and log code at the script block level.

Result

Every command or script you run is processed as one or more script blocks.

Understanding execution at the script block level is key to seeing why logging script blocks captures all code.

3

Intermediate

Enabling Script Block Logging in PowerShell

🤔Before reading on: do you think script block logging is enabled by default or must be turned on? Commit to your answer.

Concept: Script block logging is a feature that must be enabled via Group Policy or registry settings.

To enable script block logging, you can use Group Policy Editor under Computer Configuration > Administrative Templates > Windows Components > Windows PowerShell > Turn on PowerShell Script Block Logging. Alternatively, you can set the registry key HKLM\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\Enable to 1 to enable it.

Result

Once enabled, PowerShell records all script blocks executed into the Windows Event Log under Microsoft-Windows-PowerShell/Operational.

Knowing how to enable script block logging is essential to start capturing script execution details for security.

4

Intermediate

Reading Script Block Logs from Event Viewer

🤔Before reading on: do you think script block logs show only command names or full script code? Commit to your answer.

Concept: Script block logs contain the full text of executed script blocks and are stored in Windows Event Logs.

Open Event Viewer and navigate to Applications and Services Logs > Microsoft > Windows > PowerShell > Operational. Here, you will find events with ID 4104 that contain the full script block text that was executed. This allows detailed inspection of what code ran on the system.

Result

You can see the exact PowerShell code executed, not just command names or parameters.

Accessing these logs gives you powerful visibility into script activity for auditing and threat hunting.

5

Intermediate

Limitations and Performance Impact of Logging

🤔Before reading on: do you think script block logging slows down PowerShell significantly or has minimal impact? Commit to your answer.

Concept: Logging every script block can affect system performance and generate large logs.

Because script block logging records all code executed, it can increase CPU usage and disk space consumption. On busy systems, this may slow down PowerShell scripts and fill logs quickly. Administrators should balance security needs with performance by enabling logging selectively or filtering events.

Result

Enabling script block logging may impact system performance and requires log management.

Understanding these trade-offs helps you plan logging strategies that protect without harming system usability.

6

Advanced

Bypassing Script Block Logging and Detection

🤔Before reading on: do you think all PowerShell code can be captured by script block logging? Commit to your answer.

Concept: Some advanced attackers use techniques to evade script block logging, such as running code in memory or using obfuscation.

Attackers may use encoded commands, reflection, or direct API calls to run PowerShell code without triggering script block logging. For example, running PowerShell in constrained language mode or using external tools can bypass logging. Security teams must combine script block logging with other detection methods.

Result

Script block logging is powerful but not foolproof against all attack methods.

Knowing the limits of script block logging prepares you to build layered defenses and not rely on a single security control.

7

Expert

Internals of Script Block Logging in PowerShell Engine

🤔Before reading on: do you think script block logging hooks into PowerShell before or after code execution? Commit to your answer.

Concept: Script block logging hooks into the PowerShell engine to capture code just before execution, ensuring accurate logging of the exact code run.

Inside the PowerShell engine, script block logging uses event handlers that trigger when a script block is about to execute. It captures the raw script text, including dynamically generated code, before running it. This design ensures that even code created at runtime is logged. The logs are then sent to the Windows Event Log subsystem.

Result

All script blocks, including dynamically created ones, are logged before execution.

Understanding this internal hooking explains why script block logging can capture complex and runtime-generated code, making it a robust security feature.

Under the Hood

Script block logging works by hooking into the PowerShell engine's execution pipeline. When PowerShell prepares to run any script block, it triggers an event that the logging system listens to. This event captures the full text of the script block, including any code generated dynamically during runtime. The captured script block is then formatted and sent to the Windows Event Log under a special channel for PowerShell operational events. This process happens synchronously before the script block runs, ensuring no code escapes logging.

Why designed this way?

Script block logging was designed to provide deep visibility into PowerShell activity for security monitoring. Earlier logging methods only captured commands or transcripts, missing dynamically generated or obfuscated code. By integrating directly into the engine's execution pipeline, Microsoft ensured that all code, even code created on the fly, is logged. This design balances completeness with performance, as logging happens just before execution, minimizing overhead and avoiding missing any executed code.

┌───────────────────────────────┐
│ PowerShell Engine             │
│ ┌─────────────────────────┐ │
│ │ Script Block Execution   │ │
│ │ Pipeline                │ │
│ │                         │ │
│ │ ┌─────────────────────┐ │ │
│ │ │ Script Block Logging │◄┼─┤
│ │ │ Event Handler        │ │ │
│ │ └─────────────────────┘ │ │
│ └─────────────────────────┘ │
│           │                 │
│           ▼                 │
│   Windows Event Log System  │
│   (Microsoft-Windows-      │
│    PowerShell/Operational) │
└───────────────────────────────┘

Myth Busters - 4 Common Misconceptions

Quick: Does script block logging capture only scripts saved as files or all executed code? Commit to yes or no.

Common Belief: Script block logging only records scripts that are saved as files and run.

Reality: Script block logging captures all script blocks executed, including those typed interactively, generated dynamically, or run from memory.

Why it matters: Believing it only logs saved scripts causes false security confidence, missing many attack methods that use in-memory or interactive code.

Quick: Does enabling script block logging guarantee catching all malicious PowerShell activity? Commit to yes or no.

Common Belief: Enabling script block logging means all malicious PowerShell activity will be detected.

Reality: While script block logging is powerful, attackers can use techniques like obfuscation, encoded commands, or external tools to evade detection.

Why it matters: Overreliance on script block logging alone can leave systems vulnerable if other detection layers are not in place.

Quick: Does script block logging significantly slow down all PowerShell scripts? Commit to yes or no.

Common Belief: Script block logging always causes major slowdowns in PowerShell performance.

Reality: There is some performance impact, but on most systems it is minimal and acceptable. However, heavy logging on busy systems can cause noticeable slowdowns.

Why it matters: Misunderstanding performance impact may lead to disabling logging unnecessarily, reducing security visibility.

Quick: Is script block logging enabled by default on all Windows systems? Commit to yes or no.

Common Belief: Script block logging is enabled by default on Windows systems.

Reality: Script block logging is disabled by default and must be explicitly enabled by administrators.

Why it matters: Assuming it is enabled by default can cause missed detection and false assumptions about system security.

Expert Zone

1

Script block logging captures dynamically generated code, which means even code created at runtime is logged, a detail many overlook.

2

The logs include the exact script text before execution, but do not capture the output or results of the script block, requiring correlation with other logs for full context.

3

Script block logging can be combined with transcription and module logging for layered PowerShell security, but each has different performance and coverage trade-offs.

When NOT to use

Script block logging is not suitable for environments where performance is critical and logging overhead must be minimal. In such cases, selective logging or alternative monitoring like endpoint detection and response (EDR) tools should be used. Also, it is less effective against non-PowerShell attack vectors or native code exploits.

Production Patterns

In production, script block logging is often enabled via Group Policy across enterprise systems to centralize logging. Security teams use SIEM tools to collect and analyze these logs for suspicious patterns. It is common to filter logs to reduce noise and focus on high-risk script blocks, and to combine this with alerting on specific event IDs or script content.

Connections

Event Logging

Script block logging builds on the Windows Event Logging system to store and manage logs.

Understanding Windows Event Logging helps grasp how script block logs are stored, accessed, and integrated with other system logs.

Intrusion Detection Systems (IDS)

Script block logging provides raw data that IDS tools analyze to detect malicious activity.

Knowing how IDS works clarifies why detailed script block logs are valuable for automated threat detection.

Forensic Analysis

Script block logging supplies detailed execution records used in forensic investigations after security incidents.

Recognizing the role of forensic analysis shows the importance of capturing exact script code for understanding attacks.

Common Pitfalls

#1 Assuming script block logging is enabled by default and not verifying it.

Wrong approach:

Write-Host 'Checking logs' # but no logs are generated because logging is off

Correct approach:

Enable script block logging via Group Policy or registry before expecting logs.

Root cause:

Misunderstanding default system settings leads to missing critical logs.

#2 Ignoring the volume of logs generated and not managing log storage.

Wrong approach:

Enable script block logging on all systems without log rotation or filtering.

Correct approach:

Implement log management policies to archive or filter logs to prevent disk space issues.

Root cause:

Underestimating log volume causes system performance and storage problems.

#3 Relying solely on script block logging for PowerShell security.

Wrong approach:

Disable other security measures assuming script block logging is enough.

Correct approach:

Use script block logging as part of a layered security approach including endpoint protection and user education.

Root cause:

Overconfidence in one security feature leads to gaps in defense.

Key Takeaways

Script block logging records the exact PowerShell code executed, providing deep visibility for security and auditing.

It must be explicitly enabled and is not turned on by default, so administrators need to configure it carefully.

While powerful, script block logging can impact performance and generate large logs, requiring thoughtful management.

Attackers can sometimes bypass script block logging, so it should be part of a layered security strategy.

Understanding how script block logging hooks into the PowerShell engine explains why it captures even dynamically generated code.