win:powershell 400
Engine state changed to Available (classic)
Windows PowerShell classic log: the engine started a session (Windows PowerShell channel).
- Log source
- PowerShell logging
- Host type
- Windows (workstation, member server, domain controller)
- How to enable
- On by default (Windows PowerShell channel).
- Tier, host type
- Minimum
- Techniques
- 1
- Rules depending on it
- Sigma 11
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| Windows workstation | Minimum | |
| Windows member server | Minimum | |
| Windows domain controller | Minimum | |
| Windows web server (IIS), internet-facing | Minimum |
Techniques it helps detect
Rules that depend on it
Sigma 11
- Delete Volume Shadow Copies Via WMI With PowerShell by frack113
- Netcat The Powershell Version by frack113
- Nslookup PowerShell Download Cradle by Sai Prashanth Pulisetti @pulisettis, Aishwarya Singam
- PowerShell Called from an Executable Version Mismatch by Sean Metcalf (source), Florian Roth (Nextron Systems)
- PowerShell Downgrade Attack - PowerShell by Florian Roth (Nextron Systems), Lee Holmes (idea), Harish Segar (improvements)
- PowerShell Download Via Net.WebClient - PowerShell Classic by Florian Roth (Nextron Systems)
- Remote PowerShell Session (PS Classic) by Roberto Rodriguez @Cyb3rWard0g
- Renamed Powershell Under Powershell Channel by Harish Segar, frack113
- Uncommon PowerShell Hosts by Roberto Rodriguez @Cyb3rWard0g
- Use Get-NetTCPConnection by frack113
- bXOR Operator Usage In PowerShell Command Line - PowerShell Classic by Teymur Kheirkhabarov, Harish Segar