PowerShell

Provider: Microsoft-Windows-PowerShell · channel: Microsoft-Windows-PowerShell/Operational

Use the Event and Activity Reference for cross-provider lookup and Windows telemetry integrity when expected logging is missing or policy changed.

Event ID	Meaning
4103	Module logging
4104	Script Block Logging
4105	Script block invocation started
4106	Script block invocation completed

The PowerShell Operational log is especially valuable when Script Block Logging is enabled.

High-interest terms

EncodedCommand · -enc · FromBase64String · IEX · Invoke-Expression

Invoke-WebRequest · Net.WebClient · DownloadString · DownloadFile

Reflection · Assembly.Load · Add-Type · Invoke-Mimikatz

AMSI manipulation · execution-policy bypass · hidden windows · long Base64 strings

Quick pivot

Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; Id=4104; StartTime=(Get-Date).AddHours(-1)}

Pivot next: user/session, host, parent process, full script block, decoded content, downloads, child processes, DNS/network, AMSI/EDR telemetry, and persistence.