analyzing-powershell-script-block-logging

You can parse PowerShell EVTX files by extracting Event ID 4104 entries to detect obfuscated commands and encoded payloads. The tool uses python-evtx to read EVTX files and reconstructs multi-block scripts by matching ScriptBlockId with MessageNumber and MessageTotal fields.

Entropy analysis detects obfuscated PowerShell commands by measuring randomness in ScriptBlockText. High entropy scores indicate potential Base64-encoded payloads, which are then flagged alongside pattern matches for -EncodedCommand, FromBase64String, and Invoke-Expression abuse.

Yes, you need Python 3.8 or higher with the python-evtx and lxml dependencies installed to analyze PowerShell Operational EVTX files. These libraries handle EVTX parsing and XML processing for extracting and reconstructing ScriptBlockText.

Yes, you can reconstruct multi-part PowerShell scripts split across multiple Event 4104 entries. The analyzer groups ScriptBlockText fragments by their ScriptBlockId and orders them using the MessageNumber and MessageTotal fields to rebuild the complete script.

During an incident investigation, you can detect suspicious patterns in PowerShell Script Block logs including -EncodedCommand, FromBase64String, Invoke-Expression, AMSI bypass attempts, and download cradles, providing actionable findings with MITRE mappings.