win:powershell 4103
Module logging (pipeline execution)
Microsoft-Windows-PowerShell/Operational: records pipeline execution events for the modules selected by Module Logging, including command invocations and parameter values.
- Log source
- PowerShell logging
- Host type
- Windows (workstation, member server, domain controller)
- How to enable
- Turn on Module Logging with a module list (GPO: Windows Components > Windows PowerShell > Turn on Module Logging; HKLM\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging).
- Tier, host type
- Minimum
- Techniques
- 56
- Rules depending on it
- Sigma 34
Why this tier
CISA/ASD; NSA
By role
| Role | Tier | Basis |
|---|---|---|
| Windows workstation | Minimum | CISA/ASD; NSA |
| Windows member server | Minimum | CISA/ASD; NSA |
| Windows domain controller | Minimum | CISA/ASD; NSA |
| Windows web server (IIS), internet-facing | Minimum | CISA/ASD; NSA |
Techniques it helps detect
- T1007 System Service Discovery
- T1010 Application Window Discovery
- T1012 Query Registry
- T1016 System Network Configuration Discovery
- T1016.001 Internet Connection Discovery
- T1016.002 Wi-Fi Discovery
- T1027.018 Invisible Unicode
- T1033 System Owner/User Discovery
- T1036.001 Invalid Code Signature
- T1036.002 Right-to-Left Override
- T1049 System Network Connections Discovery
- T1056.002 GUI Input Capture
- T1059.001 PowerShell
- T1069 Permission Groups Discovery
- T1069.002 Domain Groups
- T1070.003 Clear Command History
- T1070.004 File Deletion
- T1070.005 Network Share Connection Removal
- T1070.008 Clear Mailbox Data
- T1082 System Information Discovery
- T1087.002 Domain Account
- T1087.003 Email Account
- T1114 Email Collection
- T1114.002 Remote Email Collection
- T1114.003 Email Forwarding Rule
- T1124 System Time Discovery
- T1132.001 Standard Encoding
- T1132.002 Non-Standard Encoding
- T1135 Network Share Discovery
- T1197 BITS Jobs
- T1201 Password Policy Discovery
- T1204.004 Malicious Copy and Paste
- T1205 Traffic Signaling
- T1216 System Script Proxy Execution
- T1216.001 PubPrn
- T1216.002 SyncAppvPublishingServer
- T1217 Browser Information Discovery
- T1218.003 CMSTP
- T1218.004 InstallUtil
- T1218.009 Regsvcs/Regasm
- T1218.013 Mavinject
- T1218.014 MMC
- T1222 File and Directory Permissions Modification
- T1222.001 Windows Permissions
- T1480 Execution Guardrails
- T1480.001 Environmental Keying
- T1505.002 Transport Agent
- T1534 Internal Spearphishing
- T1556.005 Reversible Encryption
- T1564.008 Email Hiding Rules
- T1564.011 Ignore Process Interrupts
- T1615 Group Policy Discovery
- T1674 Input Injection
- T1679 Selective Exclusion
- T1690 Prevent Command History Logging
- T1700 AI-Enabled Exfiltration
Rules that depend on it
Sigma 34
- AD Groups Or Users Enumeration Using PowerShell - PoshModule by frack113
- Alternate PowerShell Hosts - PowerShell Module by Roberto Rodriguez @Cyb3rWard0g
- Bad Opsec Powershell Code Artifacts by ok @securonix invrep_de, oscd.community
- Clear PowerShell History - PowerShell Module by Ilyas Ochkov, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community
- HackTool - Evil-WinRm Execution - PowerShell Module by Nasreddine Bencherchali (Nextron Systems)
- Invoke-Obfuscation CLIP+ Launcher - PowerShell Module by Jonathan Cheong, oscd.community
- Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module by Timur Zinniatullin, oscd.community
- Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell Module by Daniel Bohannon (@Mandiant/@FireEye), oscd.community
- Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell Module by Timur Zinniatullin, oscd.community
- Invoke-Obfuscation STDIN+ Launcher - PowerShell Module by Jonathan Cheong, oscd.community
- Invoke-Obfuscation VAR+ Launcher - PowerShell Module by Jonathan Cheong, oscd.community
- Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell Module by Timur Zinniatullin, oscd.community
- Invoke-Obfuscation Via Stdin - PowerShell Module by Nikita Nazarov, oscd.community
- Invoke-Obfuscation Via Use Clip - PowerShell Module by Nikita Nazarov, oscd.community
- Invoke-Obfuscation Via Use MSHTA - PowerShell Module by Nikita Nazarov, oscd.community
- Invoke-Obfuscation Via Use Rundll32 - PowerShell Module by Nikita Nazarov, oscd.community
- Local Firewall Rules Enumeration Via NetFirewallRule Cmdlet by Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
- Malicious PowerShell Commandlets - PoshModule by Nasreddine Bencherchali (Nextron Systems)
- Malicious PowerShell Scripts - PoshModule by frack113, Nasreddine Bencherchali (Nextron Systems)
- Potential Active Directory Enumeration Using AD Module - PsModule by Nasreddine Bencherchali (Nextron Systems), frack113
- Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell Module by Nasreddine Bencherchali (Nextron Systems), frack113
- PowerShell Decompress Commands by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
- PowerShell Get Clipboard by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
- Remote PowerShell Session (PS Module) by Roberto Rodriguez @Cyb3rWard0g, Tim Shelton
- Suspicious Computer Machine Password by PowerShell by frack113
- Suspicious Get Information for SMB Share - PowerShell Module by frack113
- Suspicious Get Local Groups Information by frack113
- Suspicious Get-ADDBAccount Usage by Florian Roth (Nextron Systems)
- Suspicious PowerShell Download - PoshModule by Florian Roth (Nextron Systems)
- Suspicious PowerShell Invocations - Generic - PowerShell Module by Florian Roth (Nextron Systems)
- Suspicious PowerShell Invocations - Specific - PowerShell Module by Florian Roth (Nextron Systems), Jonhnathan Ribeiro
- SyncAppvPublishingServer Bypass Powershell Restriction - PS Module by Ensar Şamil, @sblmsrsn, OSCD Community
- Use Get-NetTCPConnection - PowerShell Module by frack113
- Zip A Folder With PowerShell For Staging In Temp - PowerShell Module by Nasreddine Bencherchali (Nextron Systems), frack113
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| ASD ACSC / CISA et al.: PowerShell loggingBest Practices for Event Logging and Threat Detection (Aug 2024) | Names this event | quoted: module logging |
| NSA: Recommended Windows events to forwardEvent Forwarding Guidance (RecommendedEvents.csv) | Names this event | PowerShell Activities: Exception Raised |