Script-block logging is a PowerShell feature that records the content of script blocks as PowerShell processes them. Administrators can enable it through Group Policy or PowerShell configuration and send the resulting events to Windows Event Log, where they can be collected for monitoring and investigation.
These records can reveal commands and script logic that file hashes alone may miss, including activity performed by short-lived or modified scripts. In an attack investigation, defenders can review logged content alongside process, command-line, and network telemetry to understand how a PowerShell stager was used. Logging does not prove that a script completed successfully, and it may capture sensitive data; organizations should configure collection, access controls, and retention appropriately.