Windows event log ยท Microsoft-Windows-PowerShell/Operational4100 Executing pipeline

  • PowerShell
  • 7 fields
  • Microsoft-Windows-PowerShell%4Operational.evtx
  • Microsoft-Windows-PowerShell

Fields EvtxECmd extracts

7 columns in the EvtxECmd CSV

  • UserName%User%
    • %User% = /Event/EventData/Data[@Name="ContextInfo"]
  • PayloadData1Severity = %Severity%
    • %Severity% = /Event/EventData/Data[@Name="ContextInfo"]
  • PayloadData2Command Name: %CommandName%
    • %CommandName% = /Event/EventData/Data[@Name="ContextInfo"]
  • PayloadData3CommandType: %CommandType%
    • %CommandType% = /Event/EventData/Data[@Name="ContextInfo"]
  • PayloadData4Script Name: %ScriptName%
    • %ScriptName% = /Event/EventData/Data[@Name="ContextInfo"]
  • PayloadData5HostApplication: %HostApplication%
    • %HostApplication% = /Event/EventData/Data[@Name="ContextInfo"]
  • PayloadData6Host Name: %HostName%
    • %HostName% = /Event/EventData/Data[@Name="ContextInfo"]

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Microsoft-Windows-PowerShell" Guid="a0c1853b-5c40-4b15-8766-3cf6798f985a"/>
    <EventID>4100</EventID>
    <Version>1</Version>
    <Level>3</Level>
    <Task>106</Task>
    <Opcode>19</Opcode>
    <Keywords>0x0</Keywords>
    <TimeCreated SystemTime="2021-05-11 12:15:09.7936797"/>
    <EventRecordID>167340</EventRecordID>
    <Correlation ActivityID="d01b00f3-0e95-000c-341d-1ckjhg50ed701"/>
    <Execution ProcessID="3732" ThreadID="8972"/>
    <Channel>Microsoft-Windows-PowerShell/Operational</Channel>
    <Computer>HOSTNAME.domain.com</Computer>
    <Security UserID="S-1-5-21-1123545945-19945682763-6826793330-16794"/>
  </System>
  <EventData>
    <Data Name="ContextInfo">Severity = Warning,         Host Name = ConsoleHost,         Host Version = 4.0,         Host ID = 2ed08e6b-9048-4bfe-a06b-3b567920bde4a,         Host Application = powershell -ExecutionPolicy ByPass -FILE C:\Users\username\AppData\Local\5da531d1a4694f6799819de13aac2c08.ps1,         Engine Version = 4.0,         Runspace ID = 35f1b751-df3f-480f-b705-5be201b68ede,         Pipeline ID = 1,         Command Name = Add-Type,         Command Type = Cmdlet,         Script Name = C:\Windows\ltsvc\packages\ABC123465\SpeculationControl.psm1,         Command Path = ,         Sequence Number = 15,         User = DOMAIN\username,         Shell ID = Microsoft.PowerShell,</Data>
    <Data Name="UserData"></Data>
    <Data Name="Payload">Error Message = Cannot add type. Compilation errors occurred., Fully Qualified Error ID = COMPILER_ERRORS,Microsoft.PowerShell.Commands.AddTypeCommand,</Data>
  </EventData>
</Event>

References

4 links

Source: evtx/Maps/Microsoft-Windows-PowerShell-Operational_Microsoft-Windows-PowerShell_4100.map(opens in new tab) by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)