EVID 8193, 24577, 40961, 53249

EVID 8193/24577/40961/53249

Base Rule

Audit : Other Audit

MS Windows PowerShell Event

EVID 8193 : PS Runspace Object Created

Subrule

Audit : Access Success

Object Created

EVID 8194 : PS RunspacePool Object Created

Subrule

Audit : Access Success

Object Created

EVID 8195 : PS RunspacePool Opened

Subrule

Audit : Access Success

Object Accessed

EVID 8196 : PS Runspace Info

Subrule

Audit : Other Audit

MS Windows PowerShell Event

EVID 8197 : PS Runspace State Changed

Subrule

Audit : Access Success

Object Modified

EVID 24577 : PS ISE Running Script File

Subrule

Operations : Information

Script Information

EVID 24578 : PS ISE Running Script File

Subrule

Operations : Information

Script Information

EVID 24579 : PS ISE Stopped Execution

Subrule

Operations : Information

Script Information

EVID 40961 : PS Console Starting

Subrule

Audit : Startup and Shutdown

Process/Service Started

EVID 40962 : PS Console Ready

Subrule

Audit : Other Audit

MS Windows PowerShell Event

EVID 53249 : PS Scheduled Job Started

Subrule

Operations : Information

Scheduled Task Started

EVID 53250 : PS Scheduled Job Completed

Subrule

Operations : Information

Scheduled Task Completed

EVID 12039 : PS Runspace Info

Subrule

Audit : Other Audit

MS Windows PowerShell Event

Provider Name

 N/A

 N/A

Identifies the provider that logged the event. The Name and Guid attributes are included if the provider used an instrumentation manifest to define its events; otherwise, the EventSourceName attribute is included if a legacy event provider (using the Event Logging API) logged the event.

EventID

<vmid>

Number

The identifier that the provider used to identify the event.

Version

 N/A

 N/A

The version number of the event's definition.

Level

<severity>

String

The severity level defined in the event.

Task

<vendorinfo>

String

The task defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged.

Opcode

 N/A

 N/A

The opcode defined in the event. Task and opcode are typcially used to identify the location in the application from where the event was logged.

Keywords

 N/A

 N/A

A bitmask of the keywords defined in the event. Keywords are used to classify types of events (for example, events associated with reading data).

TimeCreated

 N/A

N/A 

The time stamp that identifies when the event was logged. The time stamp will include either the SystemTime attribute or the RawTime attribute.

EventRecordID

 N/A

 N/A

The record number assigned to the event when it was logged.

Correlation

 N/A

 N/A

The activity identifiers that consumers can use to group related events together.

Execution

 N/A

 N/A

Contains information about the process and thread that logged the event.

Channel

 N/A

 N/A

The channel to which the event was logged.

Computer

<dname>

Text/String

The name of the computer on which the event occurred.

Security

<domainorigin>

<login>

Text/String

 N/A

FileName

<parentprocesspath>

Text/String

 N/A