Skip to main content
Skip table of contents

EVID 4104 : PS Script Execution

Vendor Documentation

Classification

Rule Name

Rule Type

Classification

Common Event

EVID 4104: PS Script Execution

Base Rule

Audit: Access Success

Command Executed

Mapping with LogRhythm Schema

Device Key in Log MessageLogRhythm SchemaData TypeSchema Description
Provider Name N/A N/AIdentifies the provider that logged the event. The Name and Guid attributes are included if the provider used an instrumentation manifest to define its events; otherwise, the EventSourceName attribute is included if a legacy event provider (using the Event Logging API) logged the event.
EventID<vmid>NumberThe identifier that the provider used to identify the event.
Version N/A N/AThe version number of the event's definition.
Level<severity>NumberThe severity level is defined in the event.
Task<vendorinfo>NumberThe task is defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged.
Opcode N/A N/AThe opcode is defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged.
Keywords N/A N/AA bitmask of the keywords defined in the event. Keywords are used to classify types of events (for example, events associated with reading data).
TimeCreated N/A N/AThe time stamp that identifies when the event was logged. The timestamp will include either the SystemTime attribute or the RawTime attribute.
EventRecordID N/A N/AThe record number assigned to the event when it was logged.
Correlation N/A N/AThe activity identifiers that consumers can use to group related events together.
Execution N/AN/A Contains information about the process and thread that logged the event.
Channel N/A N/AThe channel to which the event was logged.
Computer<dname>Text/StringThe name of the computer on which the event occurred.
Security<domainorigin>Text/StringN/A

<login>Text/StringN/A
MessageNumber N/A N/AN/A
MessageTotal<quantity>NumberN/A
ScriptBlockText<command>Text/StringN/A
ScriptBlockId<object>Text/StringN/A
Path<objectname>Text/StringN/A
Message N/A N/AN/A
Level N/A N/AN/A
Task N/A N/AN/A
Opcode N/A N/AN/A
Channel N/A N/AN/A
Provider N/A N/AN/A
Keywords N/A N/AN/A
JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.