Question

A SOC analyst is reviewing Windows event logs after an alert flagged suspicious command execution on a finance workstation. She locates an Event ID 4104 entry containing a base64-encoded string passed through an obfuscated command that decodes to a download-and-execute routine reaching out to an external IP. Which logging capability produced this evidence, and why is it valuable for this investigation?

Accepted Answer

PowerShell script block logging, which records the deobfuscated contents of executed script blocks, revealing the decoded malicious payload

Answer

PowerShell module logging, which only records the names of loaded modules and cannot show the decoded script contents

Answer

Windows command-line process auditing (4688), which captures the raw command line but never decodes obfuscated or encoded input

Answer

Sysmon network connection logging (Event ID 3), which shows the outbound connection but provides no visibility into the script logic