PowerShellCore
3 events across 1 channel
Event ID 40961 —
Example Event
system:
provider: PowerShellCore
guid: F90714A8-5509-434A-BF6D-B1624C8A19A2
event_source_name: ''
event_id: 40961
version: 1
level: 4
task: 4
opcode: 1
keywords: 0
time_created: '2023-11-06T01:36:38.224978+00:00'
event_record_id: 13
correlation:
ActivityID: E4DB489E-1037-0001-E00D-EEE43710DA01
execution:
process_id: 20676
thread_id: 8100
channel: PowerShellCore/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-21-1992711665-1655669231-58201500-1000
event_data: {}
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 40962 —
Example Event
system:
provider: PowerShellCore
guid: F90714A8-5509-434A-BF6D-B1624C8A19A2
event_source_name: ''
event_id: 40962
version: 1
level: 4
task: 4
opcode: 2
keywords: 0
time_created: '2023-11-06T01:36:44.837777+00:00'
event_record_id: 15
correlation:
ActivityID: E4DB489E-1037-0001-E00D-EEE43710DA01
execution:
process_id: 20676
thread_id: 8100
channel: PowerShellCore/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-21-1992711665-1655669231-58201500-1000
event_data: {}
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 53504 —
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
Example Event
system:
provider: PowerShellCore
guid: F90714A8-5509-434A-BF6D-B1624C8A19A2
event_source_name: ''
event_id: 53504
version: 1
level: 4
task: 111
opcode: 10
keywords: 0
time_created: '2023-11-06T01:36:40.335523+00:00'
event_record_id: 14
correlation: {}
execution:
process_id: 20676
thread_id: 16904
channel: PowerShellCore/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-21-1992711665-1655669231-58201500-1000
event_data:
param1: '20676'
param2: DefaultAppDomain
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline