Hunting Suspicious PowerShell Execution

When to Use

• You have PowerShell script-block (Event ID 4104) and/or module logging and want to hunt abuse.
• You are testing a hypothesis that attackers use encoded commands, download cradles, or AMSI/logging bypasses.
• You need to score and decode a large volume of PowerShell events into a triage queue.

Do not use simple keyword blocklists as the sole method — admins legitimately use many of the same cmdlets; score combinations and decode before judging.

Prerequisites

• Script-block logging enabled (Event ID 4104) and exported to a queryable store.
• A baseline of normal administrative PowerShell for your environment.

Workflow

Step 1: Collect script-block events

Pull EID 4104 script-block text (and EID 4103 module logging) over the hunt window. Reassemble multi-part script blocks before analysis.

Step 2: Score suspicious constructs

Weight combinations rather than single keywords: -EncodedCommand, IEX/Invoke-Expression with Net.WebClient/Invoke-WebRequest, FromBase64String, -w hidden -nop, AMSI strings, and [Ref].Assembly reflection.

python scripts/analyst.py score events.json

Step 3: Decode payloads

Base64-decode -EncodedCommand (UTF-16LE) and recover layered encodings to read the real intent (download URLs, in-memory loaders).

Step 4: Baseline and pivot

Compare against normal admin activity; for survivors, pull the parent process, user, host, and network connections to confirm.

Step 5: Confirm and operationalize

Validate true positives, escalate to IR, and convert the scoring logic into a detection rule.

Validation

• High-score events decode to coherent malicious intent, not benign admin scripts.
• Multi-part script blocks are reassembled before scoring (no truncated false negatives).
• Confirmed cases tie to a parent process and user consistent with intrusion.

Pitfalls

• Flagging single keywords (IEX alone) and drowning in admin noise.
• Forgetting -EncodedCommand is UTF-16LE, producing garbled decodes.
• Ignoring AMSI/logging-bypass attempts that precede the real payload.

References

• See references/api-reference.md for the scorer/decoder.
• Script-block logging docs and ATT&CK T1059.001 (linked in frontmatter).