PowerShell script-block logs

Location & availability

Microsoft-Windows-PowerShell/Operational or PowerShellCore/Operational; commonly event 4104

Availability depends on engine version, provider registration, logging configuration and log retention.

Fields to examine

• ScriptBlockId and script text fragments.
• Message numbering for multi-event script blocks.
• Event time, path and process/runspace context where supplied.

What it can establish

• Support that the engine logged the recorded script-block content.

What it cannot prove

• Guarantee every conditional branch ran or the script completed successfully.
• Treat text containing a suspicious function as proof that function produced an effect.

Use it in a screenshare

1. Preserve the appropriate engine’s log for the existing historical period.
2. Reassemble fragments by script-block identity and message numbering. Read the reconstructed text without evaluating it.
3. Correlate execution context and any resulting effects with process, file or network sources. Explain disabled logging and retention gaps.

Worked example

A logged script includes a conditional cleanup branch. The logged text supports that the engine handled that block; it does not prove the branch condition was met. Look for independently recorded effects before claiming deletion.

Cross-check the finding

• PSReadLine history →Support that particular command text was retained in the examined history file.
• Security event 4688 →Support process creation recorded by the audited host.
• USN Journal / $UsnJrnl →Support recorded file/directory changes and a sequence within retained journal coverage.

Sources

• Microsoft — PowerShell logging ↗