Windows PowerShell Event ID 4104 corresponds to PowerShell Script Block Logging . It records the contents of PowerShell script blocks processed during execution, making it valuable for behavioral detection of malicious or suspicious PowerShell activity, including commands generated by offensive frameworks.
For detection engineering, 4104 telemetry provides significantly more visibility into PowerShell behavior than simply monitoring process creation. The recorded script-block content can expose suspicious functions, credential-related operations, encoded or obfuscated commands, remote-execution logic, and framework-specific scripting patterns. This makes it useful when transforming red-team observations into repeatable behavioral detections.
EventCode=4624 is a Windows Security log event representing a successful logon . Although 4624 can contribute important evidence when investigating pass-the-hash or lateral movement, it is not PowerShell Script Block Logging. The other two event codes listed do not represent the PowerShell script-block event required by the question.
The supplied Cybersecurity Defense Engineer material contains the same scenario and identifies EventCode=4104 among the choices.
Study Guide topics: PowerShell Script Block Logging, Event ID 4104, Windows telemetry, endpoint detection, red-team-to-detection workflow, behavioral analytics.
