Script Execution (9f387817-df83-432a-b56b-a8fb7f71eedd)
The execution of a text file that contains code via the interpreter.
Data Collection Measures:
- Windows Event Logs:
- Event ID 4104 (PowerShell Script Block Logging) – Captures full command-line execution of PowerShell scripts.
- Event ID 4688 (Process Creation) – Detects script execution by tracking process launches (
powershell.exe,wscript.exe,cscript.exe). - Event ID 5861 (Script Execution) – Captures script execution via Windows Defender AMSI logging.
- Sysmon (Windows):
- Event ID 1 (Process Creation) – Monitors script execution initiated by scripting engines.
- Event ID 11 (File Creation) – Detects new script files written to disk before execution.
- Endpoint Detection and Response (EDR) Tools:
- Track script execution behavior, detect obfuscated commands, and prevent malicious scripts.
- PowerShell Logging:
- Enable Module Logging: Logs all loaded modules and cmdlets.
- Enable Script Block Logging: Captures complete PowerShell script execution history.
- SIEM Detection Rules:
- Detect script execution with obfuscated, encoded, or remote URLs.
- Alert on script executions using
-EncodedCommandoriex(iwr).