Skip to content
PowerShellparser

Posts tagged: #event-logs

← Back to all posts
PowerShell Event Logs for Forensics: Every ID That Matters
A map of PowerShell's forensic event IDs across the Operational and classic Windows PowerShell logs — 4104, 4103, 400, 403, 600, 800 — and what each one proves.
powershellevent-logsdfir
PowerShell Script Block Logging (4104): A Forensics Guide
What event ID 4104 records, how Windows splits long script blocks across events, why warning-level blocks appear without full logging, and how to read it in a case.
powershellscript-block-loggingdfirevent-logs