PowerShell Reverse Shell Script Block

Cyber falter@falter

•updated Mar 13, 2026•2•0•48

Detects a common PowerShell reverse shell pattern in script block logs (EID 4104). This pattern involves creating a TCP client, getting the network stream, and using Invoke-Expression (iex) to execute commands received over the network.