https://www.powershellparser.com/en/blog Latest from Blog en Tue, 29 Sep 2026 12:42:17 GMT https://www.powershellparser.com/en/blog/analyze-powershell-logs-in-browser https://www.powershellparser.com/en/blog/analyze-powershell-logs-in-browser Step-by-step: open PowerShell .evtx logs, PSReadLine history and transcripts in a free in-browser viewer, reassemble script blocks, decode encoded commands and export CSV or JSON. Florian Amette Tue, 08 Sep 2026 00:00:00 GMT https://www.powershellparser.com/en/blog/powershell-transcription-forensics https://www.powershellparser.com/en/blog/powershell-transcription-forensics How PowerShell transcripts are structured, what the header records, how command timestamps work with -IncludeInvocationHeader, and how to investigate them. Florian Amette Mon, 07 Sep 2026 00:00:00 GMT https://www.powershellparser.com/en/blog/psreadline-consolehost-history-forensics https://www.powershellparser.com/en/blog/psreadline-consolehost-history-forensics What the PSReadLine history file records, where it lives, why it has no timestamps, and how to use it — and its limits — in an investigation. Florian Amette Sun, 06 Sep 2026 00:00:00 GMT https://www.powershellparser.com/en/blog/decode-powershell-encoded-command https://www.powershellparser.com/en/blog/decode-powershell-encoded-command How -EncodedCommand and common PowerShell obfuscation work — base64/UTF-16LE, gzip/deflate, char codes, concatenation, the format operator and backticks — and how to decode them safely. Florian Amette Sat, 05 Sep 2026 00:00:00 GMT https://www.powershellparser.com/en/blog/collect-powershell-logs-transcripts-history https://www.powershellparser.com/en/blog/collect-powershell-logs-transcripts-history Acquire the PowerShell event logs, PSReadLine history and transcripts from a live host, a triage collection or a disk image — with copy-paste commands and the gotchas. Florian Amette Fri, 04 Sep 2026 00:00:00 GMT https://www.powershellparser.com/en/blog/powershell-event-logs-forensics-guide https://www.powershellparser.com/en/blog/powershell-event-logs-forensics-guide A map of PowerShell's forensic event IDs across the Operational and classic Windows PowerShell logs — 4104, 4103, 400, 403, 600, 800 — and what each one proves. Florian Amette Thu, 03 Sep 2026 00:00:00 GMT https://www.powershellparser.com/en/blog/powershell-script-block-logging-4104-forensics https://www.powershellparser.com/en/blog/powershell-script-block-logging-4104-forensics What event ID 4104 records, how Windows splits long script blocks across events, why warning-level blocks appear without full logging, and how to read it in a case. Florian Amette Wed, 02 Sep 2026 00:00:00 GMT