Script Execution

The execution of a text file that contains code via the interpreter.

Data Collection Measures:

• Windows Event Logs:
  • Event ID 4104 (PowerShell Script Block Logging) – Captures full command-line execution of PowerShell scripts.
  • Event ID 4688 (Process Creation) – Detects script execution by tracking process launches (powershell.exe, wscript.exe, cscript.exe).
  • Event ID 5861 (Script Execution) – Captures script execution via Windows Defender AMSI logging.
• Sysmon (Windows):
  • Event ID 1 (Process Creation) – Monitors script execution initiated by scripting engines.
  • Event ID 11 (File Creation) – Detects new script files written to disk before execution.
• Endpoint Detection and Response (EDR) Tools:
  • Track script execution behavior, detect obfuscated commands, and prevent malicious scripts.
• PowerShell Logging:
  • Enable Module Logging: Logs all loaded modules and cmdlets.
  • Enable Script Block Logging: Captures complete PowerShell script execution history.
• SIEM Detection Rules:
  • Detect script execution with obfuscated, encoded, or remote URLs.
  • Alert on script executions using -EncodedCommand or iex(iwr).