Script block logging catches a split string
An attacker split strings to hide from simple keyword alerts. PowerShell event 4104 still recorded the code. Reassemble the URL and name the AMSI bypass it used.
Briefing
An analyst on WS-22 reported PowerShell windows flashing at 9:21 AM. Script block logging is on, so event 4104 in Microsoft-Windows-PowerShell/Operational holds the code that ran.
Obfuscation like 'ht'+'tp://' defeats a search for http://, but the logged script text is still there to read. Warning level on a 4104 means PowerShell itself thought the block looked suspicious.
WS-22 · Windows event logs
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.