Script block logging in PowerShell - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is Script Block Logging in PowerShell?

Script Block Logging records the full content of all PowerShell script blocks that run on a system. It helps track what commands and scripts are executed for security and troubleshooting.

intermediate

How do you enable Script Block Logging using Group Policy?

Go to Computer Configuration > Administrative Templates > Windows Components > Windows PowerShell, then enable 'Turn on PowerShell Script Block Logging'.

beginner

Which Windows Event Log channel stores Script Block Logging events?

Script Block Logging events are stored in the 'Microsoft-Windows-PowerShell/Operational' event log channel.

intermediate

What is the benefit of Script Block Logging for security teams?

It helps detect malicious scripts by capturing the exact code run, even if scripts are obfuscated or run from memory, improving threat detection.

intermediate

Can Script Block Logging impact system performance?

Yes, enabling Script Block Logging can add overhead because it records detailed script content, so it should be used thoughtfully in production environments.

Where are PowerShell Script Block Logging events stored?

A Security log

B Microsoft-Windows-PowerShell/Operational log

C System log

D Application log

Script Block Logging events are specifically stored in the Microsoft-Windows-PowerShell/Operational event log.

What does Script Block Logging capture?

A Only error messages from scripts

B Network traffic details

C User login events

D Full content of executed PowerShell script blocks

Script Block Logging captures the full content of all PowerShell script blocks that run on the system.

How can you enable Script Block Logging on a Windows machine?

A Enable it via Group Policy under Windows PowerShell settings

B Install a third-party tool

C Run a PowerShell command to disable logging

D It is enabled by default

You enable Script Block Logging by configuring Group Policy under Windows PowerShell settings.

What is a potential downside of enabling Script Block Logging?

A Disables PowerShell entirely

B Loss of script execution data

C Increased system resource usage

D Prevents script execution

Script Block Logging can increase system resource usage because it records detailed script content.

Why is Script Block Logging useful for security monitoring?

A It captures exact script code, helping detect malicious activity

B It blocks all scripts automatically

C It encrypts all PowerShell scripts

D It disables PowerShell remoting

By capturing the exact script code, Script Block Logging helps security teams detect malicious or suspicious scripts.

Explain what Script Block Logging is and how it helps in monitoring PowerShell activity.

Think about what details you want to see when a script runs.

Describe the steps to enable Script Block Logging on a Windows system using Group Policy.

Focus on the path inside Group Policy and the specific setting name.