DFIRHub

Windows event log ยท Microsoft-Windows-PowerShell/Operational4103 Pipeline executed

  • PowerShell
  • 7 fields
  • Microsoft-Windows-PowerShell%4Operational.evtx
  • Microsoft-Windows-PowerShell

Fields EvtxECmd extracts

7 columns in the EvtxECmd CSV

  • UserName%User%
    • %User% = /Event/EventData/Data[@Name="ContextInfo"]
  • PayloadData1Command Name: %CommandName%
    • %CommandName% = /Event/EventData/Data[@Name="ContextInfo"]
  • PayloadData2Host Application = %HostApplication%
    • %HostApplication% = /Event/EventData/Data[@Name="ContextInfo"]
  • PayloadData3Script Name: %ScriptName%
    • %ScriptName% = /Event/EventData/Data[@Name="ContextInfo"]
  • PayloadData4ConnectedUser: %ConnectedUser%
    • %ConnectedUser% = /Event/EventData/Data[@Name="ContextInfo"]
  • PayloadData5Host Name: %HostName%
    • %HostName% = /Event/EventData/Data[@Name="ContextInfo"]
  • PayloadData6Payload: %Payload%
    • %Payload% = /Event/EventData/Data[@Name="Payload"]

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Microsoft-Windows-PowerShell" Guid="a0c1853b-5c40-4b15-8766-3cf1c58f985a"/>
    <EventID>4103</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>106</Task>
    <Opcode>20</Opcode>
    <Keywords>0x0</Keywords>
    <TimeCreated SystemTime="2016-08-04 14:47:03.9253975"/>
    <EventRecordID>26</EventRecordID>
    <Correlation ActivityID="02cfac40-f800-0000-177d-6cd85eeed101"/>
    <Execution ProcessID="3584" ThreadID="3004"/>
    <Channel>Microsoft-Windows-PowerShell/Operational</Channel>
    <Computer>HOSTNAME</Computer>
    <Security UserID="S-1-5-21-114269873-3523254850-2066368152-500"/>
  </System>
  <EventData>
    <Data Name="ContextInfo">Severity = Informational,         Host Name = ConsoleHost,         Host Version = 5.0.10586.117,         Host ID = 0e322acd-01e5-4a77-ba16-e8eaccbd78bd,         Host Application = powershell -NoProfile -ExecutionPolicy unrestricted -Command (iex ((new-object net.webclient).DownloadString('https://chocolatey.org/install.ps1'))) &amp;gt;$null 2&amp;gt;&amp;amp;1,         Engine Version = 5.0.10586.117,         Runspace ID = a0eb7cf1-27b5-42f3-b4ef-f965ff804788,         Pipeline ID = 1,         Command Name = Add-Type,         Command Type = Cmdlet,         Script Name = C:\Users\Administrator\AppData\Local\Temp\chocolatey\chocInstall\tools\chocolateyInstall\helpers\functions\Set-EnvironmentVariable.ps1,         Command Path = ,         Sequence Number = 16,         User = HOSTNAME\Administrator,         Connected User = ,         Shell ID = Microsoft.PowerShell,</Data>
    <Data Name="UserData"></Data>
    <Data Name="Payload">CommandInvocation(Add-Type): "Add-Type", ParameterBinding(Add-Type): name="Namespace"; value="Win32", ParameterBinding(Add-Type): name="Name"; value="NativeMethods", ParameterBinding(Add-Type): name="MemberDefinition"; value="[DllImport("user32.dll", SetLastError = true, CharSet = CharSet.Auto)], public static extern IntPtr SendMessageTimeout(,     IntPtr hWnd, uint Msg, UIntPtr wParam, string lParam,,     uint fuFlags, uint uTimeout, out UIntPtr lpdwResult);",</Data>
  </Event>
</EventData>

References

2 links

Source: evtx/Maps/Microsoft-Windows-PowerShell-Operational_Microsoft-Windows-PowerShell_4103.map(opens in new tab) by Andrew Rathbun and Chad Tilbury and contributors(opens in new tab), MIT License(opens in new tab)