[Observable-Submission]: PowerShell 4104: ScriptBlockText

[michael5486]

Observable

PowerShell EventID 4104 ScriptBlockText

Observable Placement

Level 2, Column A

Research

When detecting for specific values in ScriptBlockText, we're basically looking for a string representation of another observable. For example, this could be a registry key, config file, file, or process name. However, it is easy for an adversary to alter values in ScriptBlockText...they can mangle strings, split into multiple values, permutate or do operations like XOR so that the output value is as desired, but the actual text in the script is obfuscated.

Additional Notes

See https://github.com/center-for-threat-informed-defense/summiting-the-pyramid/blob/main/docs/analytics/service_registry_permissions_weakness_check.rst for additional information

Contributed By

michael5486, RobertSchull