Florian Roth
2.5 KiB
2.5 KiB
category: ps_script
ID: bade5735-5ab0-4aa7-a642-a11be0e40872
Content
Expand
Description
This logsource guide describes how to enable the necessary logging to make use of SIGMA rules that leverage the ps_script category.
Event Source(s)
PowerShell 5
Provider: Microsoft-Windows-PowerShell
GUID: {a0c1853b-5c40-4b15-8766-3cf1c58f985a}
Channel: Microsoft-Windows-PowerShell/Operational
EventID: 4104
PowerShell 7
Provider: PowerShellCore
GUID: {f90714a8-5509-434a-bf6d-b1624c8a19a2}
Channel: PowerShellCore/Operational
EventID: 4104
Logging Setup
Provider: Microsoft-Windows-PowerShell
- Event Volume: TBD
- EventID(s):
4104
- Computer Configuration
- Administrative Templates
- Windows Components
- Windows PowerShell
- Turn On PowerShell Script Block Logging
Provider: PowerShellCore
- Event Volume: TBD
- EventID(s):
4104
If you're using gpedit.msc or similar you can enable logging for this category by following the structure below
- Computer Configuration
- Administrative Templates
- PowerShell Core
- Turn On PowerShell Script Block Logging
Note
By default when you install PowerShell 7 the logging template isn't available. You can install it by using the PowerShell script available in the installation directory
InstallPSCorePolicyDefinitions.ps1
Event Fields
Provider: Microsoft-Windows-PowerShell / EventID: 4103 (PowerShell 5)
Expand
- MessageNumber
- MessageTotal
- ScriptBlockText
- ScriptBlockId
- Path
Provider: PowerShellCore / EventID: 4103 (PowerShell 7)
Expand
- MessageNumber
- MessageTotal
- ScriptBlockText
- ScriptBlockId
- Path