DETECTING SCRIPTBLOCK SMUGGLING

Summary from the TLDR InfoSec newsletter

PowerShell Script Block Logging is one of the types of PowerShell logs that records the content of all script blocks executed within PowerShell. ScriptBlock Smuggling is a technique whereby an attacker can hide a malicious script block within a benign script block. This post tests detections for this attack in a lab environment using a test script from AtomicRedTeam. The author notes that the full script, which contains the malicious command, can still be seen in the details pane and questions the usefulness of this attack.