9 entries

PowerShell

Script block logging and what PowerShell records about the code it runs.

400 PowerShell Event 400: A PowerShell session started Worth a look PowerShell started up. This event has been written since PowerShell 2.0, needs no configuration at all, and lands in the old 'Windows PowerShell' log rather than the modern operational one — which makes it the only PowerShell evidence you can count on finding on a machine nobody prepared.
403 PowerShell Event 403: A PowerShell session ended Informational The PowerShell engine shut down. Read on its own it says nothing. Read as the closing bracket on Event 400 it gives you a session length, and session length is one of the few behavioural signals available on a machine with no other PowerShell logging.
600 PowerShell Event 600: A PowerShell provider started Worth a look PowerShell loaded one of its data providers — the components that let it treat the registry, certificates, or a remote endpoint as if they were drives. Most are unremarkable. One of them, WSMan, is how you discover that PowerShell remoting was used.
800 PowerShell Event 800: Pipeline execution details Worth a look The old Windows PowerShell log's record of a command running, written when module logging is switched on. Its value is not the command text — it is the HostApplication field, which carries the full command line of whatever launched PowerShell, including the encoded ones.
4100 PowerShell Event 4100: A PowerShell command failed Worth a look PowerShell recorded an error. This event is written whether or not anyone enabled logging, which means it frequently captures attempts that were blocked — a script stopped by execution policy, a cmdlet refused by Constrained Language Mode — on machines where nothing else would have noticed.
4103 PowerShell Event 4103: Module logging recorded a command Worth a look PowerShell recorded a command as it ran, with the values it was actually given after variables were expanded. Where script block logging shows you the code, module logging shows you the runtime — including parameter values a script only assembled at the last moment.
4104 PowerShell Event 4104: Script block logging Worth a look PowerShell recorded the actual code it was about to run. Because it logs the script after decoding and de-obfuscation, it defeats encoded commands entirely — which makes it the single most valuable thing you can enable for detecting PowerShell abuse.
40961 PowerShell Event 40961: The PowerShell console is starting Informational A PowerShell host began initialising. It is the operational log's equivalent of the classic Event 400, and it is the first event of every session — which makes it the anchor point for reconstructing what a session did, and the marker for sessions that never finished starting.
53504 PowerShell Event 53504: A PowerShell engine started in a process Informational PowerShell opened its named-pipe listener for a newly started engine, and recorded the process ID and the AppDomain name. It is routine noise with one useful property: it fires wherever the engine loads, including inside programs that are not powershell.exe.