PowerShell

Event ID	Meaning
4103	Module logging
4104	Script Block Logging

The PowerShell Operational log is especially valuable when Script Block Logging is enabled.

High-interest terms

EncodedCommand · -enc · FromBase64String · IEX · Invoke-Expression

Invoke-WebRequest · Net.WebClient · DownloadString · DownloadFile

Reflection · Assembly.Load · Add-Type · Invoke-Mimikatz

AMSI manipulation · execution-policy bypass · hidden windows · long Base64 strings

Quick pivot

Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; Id=4104; StartTime=(Get-Date).AddHours(-1)}

Pivot next: user/session, host, parent process, full script block, decoded content, downloads, child processes, DNS/network, AMSI/EDR telemetry, and persistence.