EVID 400, 403, 600

EVID 400/403/600

Base Rule

Audit : Other Audit

MS Windows PowerShell Event

EVID 400 : PS Activity Started

Sub Rule

Startup and Shutdown

Process/Service Started

EVID 403 : PS Activity Stopped

Sub Rule

Startup and Shutdown

Process/Service Stopped

EVID 600 : PS Provider Started

Sub Rule

Startup and Shutdown

Process/Service Started

Provider Name

N/A

N/A

Identifies the provider that logged the event. The Name and GUID attributes are included if the provider used an instrumentation manifest to define its events; otherwise, the EventSourceName attribute is included if a legacy event provider (using the Event Logging API) logged the event.

EventID Qualifiers="0"

<vmid>

Number

The identifier that the provider used to identify the event.

Level

<severity>

Text/String

The severity level defined in the event.

Task

<vendorinfo>

Text/String

The task defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged.

Keywords

N/A

N/A

A bitmask of the keywords defined in the event. Keywords are used to classify types of events (for example, events associated with reading data).

TimeCreated

N/A

N/A

The time stamp that identifies when the event was logged. The time stamp will include either the SystemTime attribute or the RawTime attribute.

EventRecordID

N/A

N/A

The record number assigned to the event when it was logged.

Channel

N/A

N/A

The channel to which the event was logged.

Computer

<dname>

Text/String

The name of the computer on which the event occurred.

Security

N/A

N/A

N/A

NewEngineState

<status>

Text/String

N/A

PreviousEngineState

N/A

N/A

N/A

ProviderName

N/A

N/A

N/A

NewProviderState

<status>

Text/String

N/A

SequenceNumber

N/A

N/A

N/A

HostName

<account>

Text/String

N/A

HostVersion

N/A 

N/A

N/A

HostId

N/A

N/A

N/A

HostApplication

N/A

N/A

N/A

EngineVersion

N/A

N/A 

N/A

RunspaceId

N/A

N/A

N/A

PipelineId

N/A

N/A

N/A

CommandName

N/A

N/A

N/A

CommandType

N/A

N/A

N/A

ScriptName

N/A

N/A

N/A

CommandPath

N/A

N/A

N/A

CommandLine

<command>

Text/String

N/A