Windows event log ยท Microsoft-Windows-PowerShell/Operational4100 Executing pipeline
- PowerShell
- 7 fields
Microsoft-Windows-PowerShell%4Operational.evtxMicrosoft-Windows-PowerShell
Fields EvtxECmd extracts
7 columns in the EvtxECmd CSV
- UserName
%User%- %User% = /Event/EventData/Data[@Name="ContextInfo"]
- PayloadData1
Severity = %Severity%- %Severity% = /Event/EventData/Data[@Name="ContextInfo"]
- PayloadData2
Command Name: %CommandName%- %CommandName% = /Event/EventData/Data[@Name="ContextInfo"]
- PayloadData3
CommandType: %CommandType%- %CommandType% = /Event/EventData/Data[@Name="ContextInfo"]
- PayloadData4
Script Name: %ScriptName%- %ScriptName% = /Event/EventData/Data[@Name="ContextInfo"]
- PayloadData5
HostApplication: %HostApplication%- %HostApplication% = /Event/EventData/Data[@Name="ContextInfo"]
- PayloadData6
Host Name: %HostName%- %HostName% = /Event/EventData/Data[@Name="ContextInfo"]
Sample event
Event XML from the map file
<Event>
<System>
<Provider Name="Microsoft-Windows-PowerShell" Guid="a0c1853b-5c40-4b15-8766-3cf6798f985a"/>
<EventID>4100</EventID>
<Version>1</Version>
<Level>3</Level>
<Task>106</Task>
<Opcode>19</Opcode>
<Keywords>0x0</Keywords>
<TimeCreated SystemTime="2021-05-11 12:15:09.7936797"/>
<EventRecordID>167340</EventRecordID>
<Correlation ActivityID="d01b00f3-0e95-000c-341d-1ckjhg50ed701"/>
<Execution ProcessID="3732" ThreadID="8972"/>
<Channel>Microsoft-Windows-PowerShell/Operational</Channel>
<Computer>HOSTNAME.domain.com</Computer>
<Security UserID="S-1-5-21-1123545945-19945682763-6826793330-16794"/>
</System>
<EventData>
<Data Name="ContextInfo">Severity = Warning, Host Name = ConsoleHost, Host Version = 4.0, Host ID = 2ed08e6b-9048-4bfe-a06b-3b567920bde4a, Host Application = powershell -ExecutionPolicy ByPass -FILE C:\Users\username\AppData\Local\5da531d1a4694f6799819de13aac2c08.ps1, Engine Version = 4.0, Runspace ID = 35f1b751-df3f-480f-b705-5be201b68ede, Pipeline ID = 1, Command Name = Add-Type, Command Type = Cmdlet, Script Name = C:\Windows\ltsvc\packages\ABC123465\SpeculationControl.psm1, Command Path = , Sequence Number = 15, User = DOMAIN\username, Shell ID = Microsoft.PowerShell,</Data>
<Data Name="UserData"></Data>
<Data Name="Payload">Error Message = Cannot add type. Compilation errors occurred., Fully Qualified Error ID = COMPILER_ERRORS,Microsoft.PowerShell.Commands.AddTypeCommand,</Data>
</EventData>
</Event>References
4 links
- myeventlog.com/search/show/976(opens in new tab)
- eventopedia.cloudapp.net/default.aspx?LogType=Windows+Event+Log&LogName=Microsoft-Windows-PowerShell%2FOperational&EventID=4100&action=go(opens in new tab)
- static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf(opens in new tab)
- github.com/nasbench/EVTX-ETW-Resources/blob/main/ETWProvidersCSVs/Internal/Microsoft-Windows-PowerShell.csv(opens in new tab)
Source: evtx/Maps/Microsoft-Windows-PowerShell-Operational_Microsoft-Windows-PowerShell_4100.map(opens in new tab) by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)