PowerShell 4103 — Module logging

PowerShell 4103 — Module logging. PowerShell logs pipeline execution details for configured modules.

powershell xml script execution

Source and collection

Windows PowerShell: Microsoft-Windows-PowerShell/Operational. PowerShell 7 uses PowerShellCore/Operational after registration.

Enable the corresponding module or script-block logging policy for the target edition. Read with Get-WinEvent; protect potentially sensitive script content.

Native example and provenance

upstream test fixture. Published example; no independent capture provenance claimed.

Original publisher / pinned upstream fixture — events[1].event.original

Decoded event.original string; retained the complete Event XML element, excluding any appended rendered message; native XML values unchanged.

Pinned source commit: 9ae756f00f82786ac3496ce99c2dd288c5a5c031

Download the exact sample · Offline research kit

SHA-256: 19949426f543928077fd75fb64022f97bb6634a9d7c1aa74a605541115adffbf

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-PowerShell' Guid='{a0c1853b-5c40-4b15-8766-3cf1c58f985a}'/><EventID>4103</EventID><Version>1</Version><Level>4</Level><Task>106</Task><Opcode>20</Opcode><Keywords>0x0</Keywords><TimeCreated SystemTime='2020-05-15T08:11:47.897949500Z'/><EventRecordID>3885</EventRecordID><Correlation ActivityID='{1aca0717-2acb-0002-c208-ca1acb2ad601}'/><Execution ProcessID='3984' ThreadID='3616'/><Channel>Microsoft-Windows-PowerShell/Operational</Channel><Computer>vagrant</Computer><Security UserID='S-1-5-21-1350058589-2282154016-2764056528-1000'/></System><EventData><Data Name='ContextInfo'>        Severity = Informational
        Host Name = ServerRemoteHost
        Host Version = 1.0.0.0
        Host ID = ed57761b-ba0f-4d11-87d9-fac33820d20e
        Host Application = C:\Windows\system32\wsmprovhost.exe -Embedding
        Engine Version = 5.1.17763.1007
        Runspace ID = 0729459a-8646-4176-8b02-024421a9632e
        Pipeline ID = 1
        Command Name = cmd.exe
        Command Type = Application
        Script Name =
        Command Path = C:\Windows\system32\cmd.exe
        Sequence Number = 34
        User = VAGRANT\vagrant
        Connected User = VAGRANT\vagrant
        Shell ID = Microsoft.PowerShell
</Data><Data Name='UserData'></Data><Data Name='Payload'>CommandInvocation(cmd.exe): "cmd.exe"
CommandInvocation(Out-Null): "Out-Null"
ParameterBinding(Out-Null): name="InputObject"; value="symbolic link created for C:\vagrant &lt;&lt;===&gt;&gt; \\vboxsvr\vagrant"
</Data></EventData></Event>

Structure and field interpretation

Observed structure in this specific sample
Field/pathSerialized type
Microsoft-Windows-PowerShellXML text
EventIDXML text
VersionXML text
LevelXML text
TaskXML text
OpcodeXML text
KeywordsXML text
TimeCreatedXML text
EventRecordIDXML text
CorrelationXML text
ExecutionXML text
ChannelXML text
ComputerXML text
SecurityXML text
ContextInfoXML text
UserDataXML text
PayloadXML text
EventID
4103
ContextInfo
Pipeline/module context where present.
ScriptBlockText
Script text in event 4104; can include secrets.
ScriptBlockId
Script-block correlation value, not a process identifier.

Investigation uses

Validation boundaries

Logging and automatic suspicious-script behavior differ by version; script text is not proof every command completed.

This sample passed byte-integrity and JSON/XML parsing checks, including the catalogue’s specified event discriminators. This is not a complete vendor-schema validation or a tested detection.

For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.

Ecosystem connections

References

Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.