ScriptBlock Smuggling Spoofs PowerShell Logs While Leaving Detectable Artifacts

Researchers documented ScriptBlock Smuggling, a PowerShell technique that can spoof benign content in Script Block Logging and help bypass AMSI inspection without using reflection or patching. The method abuses how PowerShell handles script blocks so that security tooling may record an innocuous command while a different payload executes, creating a misleading audit trail for defenders reviewing event 4104 logs.

Follow-up forensic testing found the technique does not fully erase evidence of malicious activity. In lab experiments, Script Block Logging captured the spoofed command, but the surrounding smuggling logic and PowerShell Module Logging event 4103 still revealed execution details, including a proof of concept that used Invoke-WebRequest to download a file. Researchers also noted reports that the approach had been adapted for Vidar Stealer delivery, while Microsoft Defender and AMSI still detected the tested samples as malicious, indicating the technique can hinder visibility but not eliminate forensic traces.