Based on a recent red team exercise, an organization is highly concerned about pass the hash attacks especially including tools like Empire. Which EventСode associated to PowerShell Script Block…

The correct answer is D. EventCode=4104. EventCode=4104 is associated with PowerShell Script Block Logging, which records the full content of executed PowerShell scripts. This is critical for detecting malicious frameworks like Empire that rely on PowerShell for pass-the-hash and other attack techniques.

Advanced Threat Hunting and Analytics

Question

Based on a recent red team exercise, an organization is highly concerned about pass the hash attacks especially including tools like Empire. Which EventСode associated to PowerShell Script Block Logging would be used to detect this activity?

Options

AEventCode=4126
BEventCode=4168
CEventCode=4624
DEventCode=4104

How the community answered

(42 responses)

A
2% (1)
B
7% (3)
C
5% (2)
D
86% (36)

Explanation

EventCode=4104 is associated with PowerShell Script Block Logging, which records the full content of executed PowerShell scripts. This is critical for detecting malicious frameworks like Empire that rely on PowerShell for pass-the-hash and other attack techniques.

Topics

#PowerShell Script Block Logging#EventCode 4104#pass-the-hash#Empire

Community Discussion

No community discussion yet for this question.

Full SPLK-5002 Practice