win:powershell

PowerShell logging

Channels: Microsoft-Windows-PowerShell/Operational (4103/4104/4105/4106); Windows PowerShell classic (400/403/600/800); PowerShellCore/Operational

Host type: Windows (workstation, member server, domain controller)
Cost class: Included
Techniques: 66
Rules listed: 404
Events: 10

Licensing

License or service: Windows PowerShell / PowerShell 7
What is free: GPO or registry enable; 4104 to PowerShell Operational log
What costs: Nothing
Notes: Page documents script block logging in detail; module/transcription via about_PowerShell_Config
Vendor page: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows
As read on: 2026-11-01

A vendor statement as read on the date shown; the cost class is the durable part.

Standards and guidance naming this source

Requirement	Relation	Basis
OMB M-26-14: Identity used	Supports an activity	our analysis: script block and module logs carry the user context
ASD ACSC / CISA et al.: Priority enterprise log sources	priority_source	quoted: administrative workstations; user computers

Techniques

Rules

Splunk 123

Sigma 230

AADInternals PowerShell Cmdlets Execution - PsScript by Austin Songer (@austinsonger), Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
AD Groups Or Users Enumeration Using PowerShell - PoshModule by frack113
AD Groups Or Users Enumeration Using PowerShell - ScriptBlock by frack113
AMSI Bypass Pattern Assembly GetType by Florian Roth (Nextron Systems)
Abuse of Service Permissions to Hide Services Via Set-Service - PS by Nasreddine Bencherchali (Nextron Systems)
Access to Browser Login Data by frack113
Active Directory Computers Enumeration With Get-AdComputer by frack113
Active Directory Group Enumeration With Get-AdGroup by frack113
Add Windows Capability Via PowerShell Script by Nasreddine Bencherchali (Nextron Systems)
Alternate PowerShell Hosts - PowerShell Module by Roberto Rodriguez @Cyb3rWard0g
Automated Collection Bookmarks Using Get-ChildItem PowerShell by frack113
Automated Collection Command PowerShell by frack113
Bad Opsec Powershell Code Artifacts by ok @securonix invrep_de, oscd.community
Certificate Exported Via PowerShell - ScriptBlock by Florian Roth (Nextron Systems)
Change PowerShell Policies to an Insecure Level - PowerShell by frack113
Change User Agents with WebRequest by frack113
Clear PowerShell History - PowerShell by Ilyas Ochkov, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community
Clear PowerShell History - PowerShell Module by Ilyas Ochkov, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community
Clearing Windows Console History by Austin Songer @austinsonger
Code Executed Via Office Add-in XLL File by frack113
Compress-Archive Cmdlet Execution by Timur Zinniatullin, oscd.community
Computer Discovery And Export Via Get-ADComputer Cmdlet - PowerShell by Nasreddine Bencherchali (Nextron Systems)
Create Volume Shadow Copy with Powershell by frack113
DMSA Link Attributes Modified by Swachchhanda Shrawan Poudel (Nextron Systems)
DMSA Service Account Created in Specific OUs - PowerShell by Swachchhanda Shrawan Poudel (Nextron Systems)
DSInternals Suspicious PowerShell Cmdlets - ScriptBlock by Nasreddine Bencherchali (Nextron Systems)
Delete Volume Shadow Copies Via WMI With PowerShell by frack113
Deletion of Volume Shadow Copies via WMI with PowerShell - PS Script by Tim Rauch, frack113
Detected Windows Software Discovery - PowerShell by Nikita Nazarov, oscd.community
DirectorySearcher Powershell Exploitation by frack113
Disable Powershell Command History by Ali Alwashali
Disable of ETW Trace - Powershell by Nasreddine Bencherchali (Nextron Systems)
Disable-WindowsOptionalFeature Command PowerShell by frack113
Dump Credentials from Windows Credential Manager With PowerShell by frack113
Enable Windows Remote Management by frack113
Enumerate Credentials from Windows Credential Manager With PowerShell by frack113
Execute Invoke-command on Remote Host by frack113
Extracting Information with PowerShell by frack113
Get-ADUser Enumeration Using UserAccountControl Flags by frack113
HackTool - Defendnot Installation via PowerShell One-Liner by Swachchhanda Shrawan Poudel (Nextron Systems)
HackTool - Evil-WinRm Execution - PowerShell Module by Nasreddine Bencherchali (Nextron Systems)
HackTool - Rubeus Execution - ScriptBlock by Christian Burkard (Nextron Systems), Florian Roth (Nextron Systems)
HackTool - WinPwn Execution - ScriptBlock by Swachchhanda Shrawan Poudel
Import PowerShell Modules From Suspicious Directories by Nasreddine Bencherchali (Nextron Systems)
Inbox Rules Creation Or Update Activity Via ExchangePowerShell Cmdlet by Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
Invoke-Obfuscation CLIP+ Launcher - PowerShell by Jonathan Cheong, oscd.community
Invoke-Obfuscation CLIP+ Launcher - PowerShell Module by Jonathan Cheong, oscd.community
Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell by Timur Zinniatullin, oscd.community
Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module by Timur Zinniatullin, oscd.community
Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell by Daniel Bohannon (@Mandiant/@FireEye), oscd.community
Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell Module by Daniel Bohannon (@Mandiant/@FireEye), oscd.community
Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell by Timur Zinniatullin, oscd.community
Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell Module by Timur Zinniatullin, oscd.community
Invoke-Obfuscation STDIN+ Launcher - PowerShell Module by Jonathan Cheong, oscd.community
Invoke-Obfuscation STDIN+ Launcher - Powershell by Jonathan Cheong, oscd.community
Invoke-Obfuscation VAR+ Launcher - PowerShell by Jonathan Cheong, oscd.community
Invoke-Obfuscation VAR+ Launcher - PowerShell Module by Jonathan Cheong, oscd.community
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell by Timur Zinniatullin, oscd.community
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell Module by Timur Zinniatullin, oscd.community
Invoke-Obfuscation Via Stdin - PowerShell Module by Nikita Nazarov, oscd.community
Invoke-Obfuscation Via Stdin - Powershell by Nikita Nazarov, oscd.community
Invoke-Obfuscation Via Use Clip - PowerShell Module by Nikita Nazarov, oscd.community
Invoke-Obfuscation Via Use Clip - Powershell by Nikita Nazarov, oscd.community
Invoke-Obfuscation Via Use MSHTA - PowerShell by Nikita Nazarov, oscd.community
Invoke-Obfuscation Via Use MSHTA - PowerShell Module by Nikita Nazarov, oscd.community
Invoke-Obfuscation Via Use Rundll32 - PowerShell by Nikita Nazarov, oscd.community
Invoke-Obfuscation Via Use Rundll32 - PowerShell Module by Nikita Nazarov, oscd.community
Lace Tempest PowerShell Evidence Eraser by Nasreddine Bencherchali (Nextron Systems)
Lace Tempest PowerShell Launcher by Nasreddine Bencherchali (Nextron Systems)
Live Memory Dump Using Powershell by Max Altgelt (Nextron Systems)
Local Firewall Rules Enumeration Via NetFirewallRule Cmdlet by Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
Mail Forwarding/Redirecting Activity Via ExchangePowerShell Cmdlet by Nasreddine Bencherchali (Nextron Systems), Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
Malicious Nishang PowerShell Commandlets by Alec Costello
Malicious PowerShell Commandlets - PoshModule by Nasreddine Bencherchali (Nextron Systems)
Malicious PowerShell Commandlets - ScriptBlock by Sean Metcalf, Florian Roth, Bartlomiej Czyz @bczyz1, oscd.community, Nasreddine Bencherchali, Tim Shelton, Mustafa Kaan Demir, Georg Lauenstein, Max Altgelt, Tobias Michalski, Austin Songer
Malicious PowerShell Keywords by Sean Metcalf (source), Florian Roth (Nextron Systems)
Malicious PowerShell Scripts - PoshModule by frack113, Nasreddine Bencherchali (Nextron Systems)
Malicious ShellIntel PowerShell Commandlets by Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems)
Manipulation of User Computer or Group Security Principals Across AD by frack113
Modify Group Policy Settings - ScriptBlockLogging by frack113
NTFS Alternate Data Stream by Sami Ruohonen
Netcat The Powershell Version by frack113
New User Account Creation Attempt Via ADSI by William Gokah (idea), Raylee Hawkins, Swachchhanda Shrawan Poudel (Nextron Systems)
New Windows Firewall Rule Added Via New-NetFirewallRule Cmdlet - ScriptBlock by frack113
Nslookup PowerShell Download Cradle by Sai Prashanth Pulisetti @pulisettis, Aishwarya Singam
PSAsyncShell - Asynchronous TCP Reverse Shell by Nasreddine Bencherchali (Nextron Systems)
Password Policy Discovery With Get-AdDefaultDomainPasswordPolicy by frack113
Potential AMSI Bypass Script Using NULL Bits by Nasreddine Bencherchali (Nextron Systems)
Potential APT FIN7 POWERHOLD Execution by Nasreddine Bencherchali (Nextron Systems)
Potential Active Directory Enumeration Using AD Module - PsModule by Nasreddine Bencherchali (Nextron Systems), frack113
Potential Active Directory Enumeration Using AD Module - PsScript by frack113, Nasreddine Bencherchali
Potential COM Objects Download Cradles Usage - PS Script by frack113
Potential Data Exfiltration Over SMTP Via Send-MailMessage Cmdlet by frack113
Potential Data Exfiltration Via Audio File by Nasreddine Bencherchali (Nextron Systems)
Potential In-Memory Execution Using Reflection.Assembly by frack113
Potential Invoke-Mimikatz PowerShell Script by Tim Rauch, Elastic (idea)
Potential Keylogger Activity by Nasreddine Bencherchali (Nextron Systems)
Potential POWERTRASH Script Execution by Nasreddine Bencherchali (Nextron Systems)
Potential Packet Capture Activity Via Start-NetEventSession - ScriptBlock by frack113
Potential Persistence Via PowerShell User Profile Using Add-Content by frack113, Nasreddine Bencherchali (Nextron Systems)
Potential Persistence Via Security Descriptors - ScriptBlock by Nasreddine Bencherchali (Nextron Systems)
Potential PowerShell Obfuscation Using Alias Cmdlets by frack113
Potential PowerShell Obfuscation Using Character Join by Nasreddine Bencherchali (Nextron Systems)
Potential Registry Reconnaissance Via PowerShell Script by frack113
Potential RemoteFXvGPUDisablement.EXE Abuse by frack113, Nasreddine Bencherchali (Nextron Systems)
Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell Module by Nasreddine Bencherchali (Nextron Systems), frack113
Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell ScriptBlock by Nasreddine Bencherchali (Nextron Systems)
Potential Suspicious PowerShell Keywords by Florian Roth (Nextron Systems), Perez Diego (@darkquassar), Tuan Le (NCSGroup)
Potential Suspicious Windows Feature Enabled by frack113
Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock by frack113
Potential WinAPI Calls Via PowerShell Scripts by Nasreddine Bencherchali (Nextron Systems), Nikita Nazarov, oscd.community
Potentially Suspicious Call To Win32_NTEventlogFile Class - PSScript by Nasreddine Bencherchali (Nextron Systems)
PowerShell ADRecon Execution by Bhabesh Raj
PowerShell Called from an Executable Version Mismatch by Sean Metcalf (source), Florian Roth (Nextron Systems)
PowerShell Create Local User by @ROxPinTeddy
PowerShell Credential Prompt by John Lambert (idea), Florian Roth (Nextron Systems)
PowerShell Decompress Commands by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
PowerShell Deleted Mounted Share by oscd.community, @redcanary, Zach Stanford @svch0st
PowerShell Downgrade Attack - PowerShell by Florian Roth (Nextron Systems), Lee Holmes (idea), Harish Segar (improvements)
PowerShell Download Via Net.WebClient - PowerShell Classic by Florian Roth (Nextron Systems)
PowerShell Dynamic Module Invocation Via ExportedCommands Array Index - PS Script by Norbert Jaśniewicz (AlphaSOC)
PowerShell Get Clipboard by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
PowerShell Get-Process LSASS in ScriptBlock by Florian Roth (Nextron Systems)
PowerShell Hotfix Enumeration by Nasreddine Bencherchali (Nextron Systems)
PowerShell ICMP Exfiltration by Bartlomiej Czyz @bczyz1, oscd.community
PowerShell PSAttack by Sean Metcalf (source), Florian Roth (Nextron Systems)
PowerShell Remote Session Creation by frack113
PowerShell Script Change Permission Via Set-Acl - PsScript by frack113, Nasreddine Bencherchali (Nextron Systems)
PowerShell Script With File Hostname Resolving Capabilities by Nasreddine Bencherchali (Nextron Systems)
PowerShell Script With File Upload Capabilities by frack113
PowerShell Set-Acl On Windows Folder - PsScript by frack113, Nasreddine Bencherchali (Nextron Systems)
PowerShell ShellCode by David Ledbetter (shellcode), Florian Roth (Nextron Systems)
PowerShell WMI Win32_Product Install MSI by frack113
PowerShell Web Access Installation - PsScript by Michael Haag
PowerShell Write-EventLog Usage by Nasreddine Bencherchali (Nextron Systems)
PowerView PowerShell Cmdlets - ScriptBlock by Bhabesh Raj
Powershell Add Name Resolution Policy Table Rule by Borna Talebi
Powershell Create Scheduled Task by frack113
Powershell DNSExfiltration by frack113
Powershell Detect Virtualization Environment by frack113, Duc.Le-GTSC
Powershell Directory Enumeration by frack113
Powershell Execute Batch Script by frack113
Powershell Install a DLL in System Directory by frack113, Nasreddine Bencherchali (Nextron Systems)
Powershell Keylogging by frack113
Powershell Local Email Collection by frack113
Powershell LocalAccount Manipulation by frack113
Powershell MsXml COM Object by frack113, MatilJ
Powershell Sensitive File Discovery by frack113
Powershell Store File In Alternate Data Stream by frack113
Powershell Suspicious Win32_PnPEntity by frack113
Powershell Timestomp by frack113
Powershell Token Obfuscation - Powershell by frack113
Powershell WMI Persistence by frack113
Powershell XML Execute Command by frack113
Recon Information for Export with PowerShell by frack113
Registry Modification Attempt Via VBScript - PowerShell by Swachchhanda Shrawan Poudel (Nextron Systems)
Registry-Free Process Scope COR_PROFILER by frack113
Remote PowerShell Session (PS Classic) by Roberto Rodriguez @Cyb3rWard0g
Remote PowerShell Session (PS Module) by Roberto Rodriguez @Cyb3rWard0g, Tim Shelton
Remove Account From Domain Admin Group by frack113
Renamed Powershell Under Powershell Channel by Harish Segar, frack113
Replace Desktop Wallpaper by Powershell by frack113
Root Certificate Installed - PowerShell by oscd.community, @redcanary, Zach Stanford @svch0st
SMB over QUIC Via PowerShell Script by frack113
Security Software Discovery Via Powershell Script by frack113, Anish Bogati, Nasreddine Bencherchali (Nextron Systems)
Service Registry Permissions Weakness Check by frack113
Silence.EDA Detection by Alina Stepchenkova, Group-IB, oscd.community
Suspicious Computer Machine Password by PowerShell by frack113
Suspicious Connection to Remote Account by frack113
Suspicious Eventlog Clear by Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
Suspicious FromBase64String Usage On Gzip Archive - Ps Script by frack113
Suspicious GPO Discovery With Get-GPO by frack113
Suspicious Get Information for SMB Share by frack113
Suspicious Get Information for SMB Share - PowerShell Module by frack113
Suspicious Get Local Groups Information by frack113
Suspicious Get Local Groups Information - PowerShell by frack113
Suspicious Get-ADDBAccount Usage by Florian Roth (Nextron Systems)
Suspicious Get-ADReplAccount by frack113
Suspicious GetTypeFromCLSID ShellExecute by frack113
Suspicious Hyper-V Cmdlets by frack113
Suspicious IO.FileStream by frack113
Suspicious Invoke-Item From Mount-DiskImage by frack113
Suspicious Kerberos Ticket Request via PowerShell Script - ScriptBlock by frack113
Suspicious Mount-DiskImage by frack113
Suspicious New-PSDrive to Admin Share by frack113
Suspicious Non PowerShell WSMAN COM Provider by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Suspicious PowerShell Download - PoshModule by Florian Roth (Nextron Systems)
Suspicious PowerShell Download - Powershell Script by Florian Roth (Nextron Systems)
Suspicious PowerShell Get Current User by frack113
Suspicious PowerShell Invocations - Generic by Florian Roth (Nextron Systems)
Suspicious PowerShell Invocations - Generic - PowerShell Module by Florian Roth (Nextron Systems)
Suspicious PowerShell Invocations - Specific by Florian Roth (Nextron Systems), Jonhnathan Ribeiro
Suspicious PowerShell Invocations - Specific - PowerShell Module by Florian Roth (Nextron Systems), Jonhnathan Ribeiro
Suspicious PowerShell Mailbox Export to Share - PS by Nasreddine Bencherchali (Nextron Systems)
Suspicious PowerShell WindowStyle Option by frack113, Tim Shelton (fp AWS)
Suspicious Process Discovery With Get-Process by frack113
Suspicious SSL Connection by frack113
Suspicious Service DACL Modification Via Set-Service Cmdlet - PS by Nasreddine Bencherchali (Nextron Systems)
Suspicious Start-Process PassThru by frack113
Suspicious TCP Tunnel Via PowerShell Script by Nasreddine Bencherchali (Nextron Systems)
Suspicious Unblock-File by frack113
Suspicious X509Enrollment - Ps Script by frack113
SyncAppvPublishingServer Bypass Powershell Restriction - PS Module by Ensar Şamil, @sblmsrsn, OSCD Community
SyncAppvPublishingServer Execution to Bypass Powershell Restriction by Ensar Şamil, @sblmsrsn, OSCD Community
Tamper Windows Defender - PSClassic by frack113, Nasreddine Bencherchali (Nextron Systems)
Tamper Windows Defender - ScriptBlockLogging by frack113, elhoim, Tim Shelton (fps, alias support), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)
Tamper Windows Defender Remove-MpPreference - ScriptBlockLogging by Nasreddine Bencherchali (Nextron Systems)
Testing Usage of Uncommonly Used Port by frack113
Troubleshooting Pack Cmdlet Execution by Nasreddine Bencherchali (Nextron Systems)
Uncommon PowerShell Hosts by Roberto Rodriguez @Cyb3rWard0g
Unsigned AppX Installation Attempt Using Add-AppxPackage - PsScript by Nasreddine Bencherchali (Nextron Systems)
Usage Of Web Request Commands And Cmdlets - ScriptBlock by James Pemberton / @4A616D6573
Use Get-NetTCPConnection by frack113
Use Get-NetTCPConnection - PowerShell Module by frack113
Use Of Remove-Item to Delete File - ScriptBlock by frack113
User Discovery And Export Via Get-ADUser Cmdlet - PowerShell by Nasreddine Bencherchali (Nextron Systems)
Veeam Backup Servers Credential Dumping Script Execution by Nasreddine Bencherchali (Nextron Systems)
WMIC Unquoted Services Path Lookup - PowerShell by Nasreddine Bencherchali (Nextron Systems)
WMImplant Hack Tool by NVISO
WinAPI Function Calls Via PowerShell Scripts by Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems)
WinAPI Library Calls Via PowerShell Scripts by Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems)
Windows Defender Exclusions Added - PowerShell by Tim Rauch, Elastic (idea)
Windows Firewall Profile Disabled by Austin Songer @austinsonger
Windows Mail App Mailbox Access Via PowerShell Script by frack113
Windows Screen Capture with CopyFromScreen by frack113
Winlogon Helper DLL by Timur Zinniatullin, oscd.community
Zip A Folder With PowerShell For Staging In Temp - PowerShell Module by Nasreddine Bencherchali (Nextron Systems), frack113
Zip A Folder With PowerShell For Staging In Temp - PowerShell by Nasreddine Bencherchali (Nextron Systems), frack113
Zip A Folder With PowerShell For Staging In Temp - PowerShell Script by Nasreddine Bencherchali (Nextron Systems), frack113
bXOR Operator Usage In PowerShell Command Line - PowerShell Classic by Teymur Kheirkhabarov, Harish Segar

Elastic 51

Events

Minimum (5)

400Engine state changed to Available (classic)
4103Module logging (pipeline execution)
4104Script block logging (script block text)
4105Script block invocation started
4106Script block invocation completed

Recommended (4)

169Remote Connection
403Engine state changed to Stopped (classic)
800Pipeline execution details (classic)
transcriptPowerShell transcription (file)

Listed (1)

600Provider started (classic)