In a recent discussion on SigmaHQ. L015H4CK (Louis) brought up a topic that is often forgotten or ignored. Which is the idea that PowerShell ScriptBlock logs can and will be split into different "blocks" if the script is large enough (i.e the size of one block exceeds the size of an event log msg size). This opens up an interesting area of bypass for powershell detections that are string / scrtipblock based that are applied only on a single block at a time. In theory an attacker can pad a malicious script with enough garbage data at the start so that every "malicious" string is located near the end of the block. Which in turns will make the EventLog/PowerShell provider split the string into a different block which will break the detection. This piece by Louis highlights this concept a bit more lolcads.github.io/posts/2024… give it a read.