name: Powershell Script Block Logging 4104
id: 5cfd0c72-d989-47a0-92f9-6edc6f8d3564
version: 1
date: '2024-07-18'
author: Patrick Bareiss, Splunk
description: Data source object for Powershell Script Block Logging 4104
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
supported_TA:
- name: Splunk Add-on for Microsoft Windows
  url: https://splunkbase.splunk.com/app/742
  version: 9.0.0
fields:
- _time
- ActivityID
- Channel
- Computer
- EventCode
- EventData_Xml
- EventID
- EventRecordID
- Guid
- Keywords
- Level
- MessageNumber
- MessageTotal
- Name
- Opcode
- Path
- ProcessID
- RecordNumber
- ScriptBlockId
- ScriptBlockText
- SystemTime
- System_Props_Xml
- Task
- ThreadID
- UserID
- Version
- date_hour
- date_mday
- date_minute
- date_month
- date_second
- date_wday
- date_year
- date_zone
- dvc
- dvc_nt_host
- event_id
- eventtype
- host
- id
- index
- linecount
- punct
- signature_id
- source
- sourcetype
- splunk_server
- tag
- tag::eventtype
- timeendpos
- timestartpos
- user_id
- vendor_product
field_mappings:
- data_model: cim
  data_set: Endpoint.Processes
  mapping:
    Computer: Processes.dest
    Path: Processes.process_path
    ScriptBlockId: Processes.process_id
    ScriptBlockText: Processes.process
    UserID: Processes.user_id
- data_model: ocsf
  mapping:
    Computer: device.hostname
    Path: process.file.path
    ScriptBlockId: process.uid
    ScriptBlockText: process.cmd_line
    UserID: actor.user.uid
example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider
  Name='Microsoft-Windows-PowerShell' Guid='{A0C1853B-5C40-4B15-8766-3CF1C58F985A}'/><EventID>4104</EventID><Version>1</Version><Level>5</Level><Task>2</Task><Opcode>15</Opcode><Keywords>0x0</Keywords><TimeCreated
  SystemTime='2022-05-02T12:39:41.710158900Z'/><EventRecordID>112748</EventRecordID><Correlation
  ActivityID='{547232D9-5B2B-0007-6CA6-72542B5BD801}'/><Execution ProcessID='5336'
  ThreadID='2228'/><Channel>Microsoft-Windows-PowerShell/Operational</Channel><Computer>win-dc-mhaag-attack-range-270.attackrange.local</Computer><Security
  UserID='S-1-5-21-2059343465-2300599999-2417073716-500'/></System><EventData><Data
  Name='MessageNumber'>1</Data><Data Name='MessageTotal'>1</Data><Data Name='ScriptBlockText'>function
  New-Mutex($MutexName) {