User Discovery With Environment Variables in PowerShell Script Block

This analytic detects the use of PowerShell environment variables to identify the current logged-in user by leveraging PowerShell Script Block Logging (EventCode=4104). Specifically, it monitors script blocks containing `$env:UserName` or `[System.Environment]::UserName`. This activity is significant because adversaries and Red Teams often use it for situational awareness and Active Directory discovery on compromised endpoints. If confirmed malicious, this activity could allow attackers to gain insights into user context, aiding in further exploitation and lateral movement within the network.