EVID 4100, 4101, 4102, 4103

EVID 4100/4101/4102/4103

Base Rule

Audit: Other Audit

MS Windows PowerShell Event

EVID 4100: PS Error

Sub Rule

Operations: Error

General Error Message

EVID 4101: PS Activity

Sub Rule

Audit: Other Audit

MS Windows PowerShell Event

EVID 4102: PS Error

Sub Rule

Operations: Error

General Error Message

EVID 4103: PS Event

Sub Rule

Audit: Other Audit

MS Windows PowerShell Event

Provider Name

N/A

N/A

Identifies the provider that logged the event. The Name and GUID attributes are included if the provider used an instrumentation manifest to define its events; otherwise, the EventSourceName attribute is included if a legacy event provider (using the Event Logging API) logged the event.

EventID

<vmid>

Number

The identifier that the provider used to identify the event.

Version

N/A

Number

The version number of the event's definition.

Level

<severity>

String

The severity level is defined in the event.

Task

<vendorinfo>

String

The task is defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged.

Opcode

N/A

N/A

The opcode is defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged.

Keywords

N/A

N/A

A bitmask of the keywords defined in the event. Keywords are used to classify types of events (for example, events associated with reading data).

TimeCreated

N/A

N/A

The time stamp that identifies when the event was logged. The timestamp will include either the SystemTime attribute or the RawTime attribute.

EventRecordID

N/A

N/A

The record number assigned to the event when it was logged.

Correlation

N/A

N/A

The activity identifiers that consumers can use to group related events together.

Execution

N/A

N/A

Contains information about the process and thread that logged the event.

Channel

N/A

N/A

The channel to which the event was logged.

Computer

<dname>

Text/String

The name of the computer on which the event occurred.

Security

<domainorigin>

Text/String

N/A

N/A

<login>

Text/String

N/A

Severity 

N/A

N/A

N/A

Host Name

N/A

N/A

N/A

Host Version

N/A

N/A

N/A

Host ID

N/A

N/A

N/A

Host Application

N/A

N/A

N/A

Engine Version

N/A

N/A

N/A

Runspace ID

N/A

N/A

N/A

Pipeline ID

N/A

N/A

N/A

Command Name

<action>

Text/String

N/A

Command Type

<objecttype>

Text/String

N/A 

Script Name

<object>

Text/String

N/A 

Command Path

N/A

N/A

N/A

Sequence Number

N/A

N/A

N/A

User 

N/A

N/A

N/A

Connected User

N/A

N/A 

N/A

Shell ID

N/A

N/A

N/A

UserData

N/A

N/A

N/A

Error Message

<command>

Text/String

N/A