EVID 8193, 24577, 40961, 53249
Vendor Documentation
Classification
Rule Name | Rule Type | Classification | Common Event |
|---|---|---|---|
EVID 8193/24577/40961/53249 | Base Rule | Audit : Other Audit | MS Windows PowerShell Event |
EVID 8193 : PS Runspace Object Created | Subrule | Audit : Access Success | Object Created |
EVID 8194 : PS RunspacePool Object Created | Subrule | Audit : Access Success | Object Created |
EVID 8195 : PS RunspacePool Opened | Subrule | Audit : Access Success | Object Accessed |
EVID 8196 : PS Runspace Info | Subrule | Audit : Other Audit | MS Windows PowerShell Event |
EVID 8197 : PS Runspace State Changed | Subrule | Audit : Access Success | Object Modified |
EVID 24577 : PS ISE Running Script File | Subrule | Operations : Information | Script Information |
EVID 24578 : PS ISE Running Script File | Subrule | Operations : Information | Script Information |
EVID 24579 : PS ISE Stopped Execution | Subrule | Operations : Information | Script Information |
EVID 40961 : PS Console Starting | Subrule | Audit : Startup and Shutdown | Process/Service Started |
EVID 40962 : PS Console Ready | Subrule | Audit : Other Audit | MS Windows PowerShell Event |
EVID 53249 : PS Scheduled Job Started | Subrule | Operations : Information | Scheduled Task Started |
EVID 53250 : PS Scheduled Job Completed | Subrule | Operations : Information | Scheduled Task Completed |
Mapping with LogRhythm Schema
| Device Key in Log Message | LogRhythm Schema | Data Type | Schema Description |
|---|---|---|---|
| Provider Name | N/A | N/A | Identifies the provider that logged the event. The Name and Guid attributes are included if the provider used an instrumentation manifest to define its events; otherwise, the EventSourceName attribute is included if a legacy event provider (using the Event Logging API) logged the event. |
| EventID | <vmid> | Number | The identifier that the provider used to identify the event. |
| Version | N/A | N/A | The version number of the event's definition. |
| Level | <severity> | String | The severity level defined in the event. |
| Task | <vendorinfo> | String | The task defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged. |
| Opcode | N/A | N/A | The opcode defined in the event. Task and opcode are typcially used to identify the location in the application from where the event was logged. |
| Keywords | N/A | N/A | A bitmask of the keywords defined in the event. Keywords are used to classify types of events (for example, events associated with reading data). |
| TimeCreated | N/A | N/A | The time stamp that identifies when the event was logged. The time stamp will include either the SystemTime attribute or the RawTime attribute. |
| EventRecordID | N/A | N/A | The record number assigned to the event when it was logged. |
| Correlation | N/A | N/A | The activity identifiers that consumers can use to group related events together. |
| Execution | N/A | N/A | Contains information about the process and thread that logged the event. |
| Channel | N/A | N/A | The channel to which the event was logged. |
| Computer | <dname> | Text/String | The name of the computer on which the event occurred. |
| Security | <domainorigin> | Text/String | N/A |
| N/A | <login> | Text/String | N/A |