Skip to content
PowerShellparser

Glossary

Module Logging (4103)

PowerShell pipeline execution logging: event ID 4103 records commands and bound parameters as they run.

Module logging records pipeline execution details, meaning the commands PowerShell invoked and the parameters bound to them, to event ID 4103 in the Microsoft-Windows-PowerShell/Operational log. It is enabled by the Group Policy setting "Turn on Module Logging" under Administrative Templates → Windows Components → Windows PowerShell, either for a list of module names or for all modules with *. It is off by default.

Why it matters in investigations

Module logging complements Script Block Logging. Event 4104 shows the code that was compiled; 4103 shows what actually executed and with which argument values, including values computed at run time that never appear literally in the script. When a script builds a URL from variables, 4104 shows the variables while 4103 shows the final Uri.

Each 4103 event has a ContextInfo block naming the host application, the user, the engine version and the command, and a Payload with one CommandInvocation line per command and one ParameterBinding line per bound parameter. With * enabled it is verbose and noisy, so it is best read filtered on the cmdlets that matter: web requests, process creation, file writes and Defender settings.

Example

An abridged Payload for a file download:

CommandInvocation(Invoke-WebRequest): "Invoke-WebRequest"
ParameterBinding(Invoke-WebRequest): name="Uri"; value="https://files.example/tools.zip"
ParameterBinding(Invoke-WebRequest): name="OutFile"; value="C:\Users\Public\tools.zip"

The parser reads the ContextInfo fields and the payload, so the entry shows the user, host application and command name alongside the invocation. It runs the same findings over the payload and the host command line as over any other entry, here a download.

Merge 4103 with the other PowerShell events in the PowerShell Parser, and see the PowerShell event-log guide for every event ID side by side.