Skip to content
Sign In
Telemetry

win:powershell 800

Pipeline execution details (classic)

Windows PowerShell classic log: pipeline execution details for modules with LogPipelineExecutionDetails enabled.

Log source
PowerShell logging
Host type
Windows (workstation, member server, domain controller)
How to enable
Module logging on the Windows PowerShell channel.
Tier, host type
Recommended
Techniques
0
Rules depending on it
none

Why this tier

NSA

By role

RoleTierBasis
Windows workstationRecommendedNSA
Windows member serverRecommendedNSA
Windows domain controllerRecommendedNSA
Windows web server (IIS), internet-facingRecommendedNSA

Techniques it helps detect

No ATT&CK analytic names this event. Its standing comes from the standards and rules below.

Rules that depend on it

No vendor rule names this event or source directly.

Standards and guidance naming it

RequirementRelationBasis
NSA: Recommended Windows events to forwardEvent Forwarding Guidance (RecommendedEvents.csv)Names this eventPowerShell Activities: Get-MessageTrackingLog cmdlet

Dataset version 0.5.3, built 2026-11-08, from public sources only. Vendor rule names, requirement text and ATT&CK content are reproduced as published; the links between them are the authors' analysis. See the references for each source, its version and its license.