Skip to main content

Windows PowerShell event channels

3channels
3curated reasons
1themes fed
Livestatus

PowerShell engine and script-block channels, bound as one feed: the modern engine's operational and admin arms and the classic Windows PowerShell log. Script-block records (4104) arrive as fragments and are merged back into one event per block, at the level the engine stated; the first copy of a block carries the whole script up to 256 KB, and a repeat of the same block within 14 days ships a receipt that keeps the run countable and points at the copy already stored. Module and pipeline records (4103) are kept as the engine wrote them. The classic provider-lifecycle flood (600) is dropped. A merged block is labelled where it is recognisable: generated framework code, a repeat of a body already stored, or a block naming a command on the watchlist of operations worth reviewing. Script bodies pass the shared credential redaction before the event leaves the host.

Feed id: win.powershell.eventlog.

Channels​

This feed binds 3 Windows Event Log channels as one reporting axis. A channel that a given Windows edition, role or OEM does not provide is absent on that endpoint; the rest still collect.

ChannelTicket class
Microsoft-Windows-PowerShell/Operational
Microsoft-Windows-PowerShell/Admin
Windows PowerShell

Severity​

A curated reason states its own severity, listed below. Every other event on these channels keeps the severity its own provider stated, capped at Warning.

Curated reasons​

Severity here is what the condition is worth to the person holding the ticket, not the level the provider stated for itself.

ReasonTicket classSeverity
win_powershell_script_block_framework_codesecurity_auditInfo
win_powershell_script_block_repeatsecurity_auditInfo
win_powershell_script_block_watchlist_hitsecurity_auditNotable-normal by default; the destructive, protection-tampering and credential categories rate a rung higher. Never a failure claim: the event records the block, not an outcome.

win_powershell_script_block_framework_code​

A PowerShell script block that is generated framework code, such as a proxy module built when a command set is imported, rather than a script someone wrote.

Severity: Info

Channel: Microsoft-Windows-PowerShell/Operational

Provider: Microsoft-Windows-PowerShell

Event ids: 4104

What you see: A PowerShell script block event whose line reads "framework block". The line names the signature that matched, the functions the block declares, the commands it calls and the content hash. The script text is not attached.

What it means: The block is generated code: the proxy module PowerShell builds when a command set is imported, an implicit-remoting proxy, or a diagnostic package. It is the same on every host that imported the same module: it names which command sets are in use, not what anyone ran.

What to do: No action needed. Read the signature and declared names to see which command sets a host imports.

When to ignore it: Ignore the command names inside these blocks: a storage proxy names Format-Volume and Remove-Item without either one running.

References:

Example

Creating Scriptblock text (1 of 1): armfw

channel: Microsoft-Windows-PowerShell/Operational
provider_name: Microsoft-Windows-PowerShell
event_id: 4104
event_data.ScriptBlockText: Set-StrictMode -Off
function __cmdletization_BindCommonParameters {
  # Microsoft.PowerShell.Cmdletization.Cim
}

SparkLogs: win_powershell_script_block_framework_code, Info, win_powershell_script_block_framework_code: BENIGN: framework block; 4 lines; signature "cim_cmdletization_proxy"; declares "__cmdletization_BindCommonParameters"; calls "Set-StrictMode"; sha256 "594a1ec8f520091f7dbaa10f69c875a76f6833af94713ec5ac04f199905fdfeb"

Where to look next:

  • Use the signature and the declared names to see which command sets are imported on the host.
  • The body is not stored for these blocks; the hash identifies the block if a copy is needed.

Related reasons:

Generated framework blocks are identical across every host that imported the same module, so they are useful for inventory questions and not for questions about what a person did.

win_powershell_script_block_repeat​

A PowerShell script block ran again with the same content as one already recorded on this host, so this event is a receipt for the run rather than a second copy of the script.

Severity: Info

Channel: Microsoft-Windows-PowerShell/Operational

Provider: Microsoft-Windows-PowerShell

Event ids: 4104

What you see: A PowerShell script block line that opens with a repeat count, followed by the time the body was first stored and the record it was first stored on. The script text is not attached.

What it means: The host ran a block whose content matches one already stored in the last 14 days; this event counts the run instead of duplicating the script. The content key ignores GUIDs and per-run temporary module names, so two runs differing only in such an identifier count as the same block; the target field holds the value that differs.

What to do: Follow first_seen_record_id to the record holding the full script text. Count these receipts along with that first copy when you need a run rate for the script.

References:

Where to look next:

  • The count says how many runs of this exact body the window covers, this one included.
  • first_seen_record_id names the record carrying the full script text.

Related reasons:

Counting runs of one script means counting these receipts plus the first full copy; the receipt is not a duplicate of that copy and should not be filtered out of a rate.

win_powershell_script_block_watchlist_hit​

A PowerShell script block named a command on the watchlist of operations worth reviewing, such as deleting data, changing a protection setting, handling a credential, or sending data out.

Severity: Notable-normal by default; the destructive, protection-tampering and credential categories rate a rung higher. Never a failure claim: the event records the block, not an outcome.

Impact: The named command was present in a block compiled on this host. Whether it ran, and what it did, is not recorded here, so treat this as a pointer into the script rather than as an outcome.

Channel: Microsoft-Windows-PowerShell/Operational

Provider: Microsoft-Windows-PowerShell

Event ids: 4104

What you see: A PowerShell script block event whose line opens with a category, such as "destructive script block" or "encoded script block". The line carries the tokens that matched, the commands the block calls, and any path, host or account its parameters name.

What it means: The block named a command on the list of operations worth reviewing: deleting data, changing a protection setting, handling a credential, sending data out, or running code held in a string. Event 4104 is written when a block is compiled; it does not say the command ran.

What to do: Read the matched tokens and the called names, then decide whether the block belongs to automation you already run before treating it as unexpected.

When to ignore it: Matching is text: a command named in a comment or a string scores like one the block calls, so read the block before trusting the category.

References:

Example

Creating Scriptblock text (1 of 1): armwl

channel: Microsoft-Windows-PowerShell/Operational
provider_name: Microsoft-Windows-PowerShell
event_id: 4104
event_data.ScriptBlockText: Enter-PSSession -ComputerName fileserver01

SparkLogs: win_powershell_script_block_watchlist_hit, Notice, win_powershell_script_block_watchlist_hit: NOTABLE: remoting script block; 1 lines; remoting; matched "enter-pssession"; calls "Enter-PSSession"; targets computer_name "fileserver01"; sha256 "81fa9b2dddbe2556537c0ecf8238c093c2c39012c829e7dafd66c8da941792f8"

Example

Creating Scriptblock text (1 of 1): armdes

channel: Microsoft-Windows-PowerShell/Operational
provider_name: Microsoft-Windows-PowerShell
event_id: 4104
event_data.ScriptBlockText: Remove-Item -Path C:/Data -Recurse -Force

SparkLogs: win_powershell_script_block_watchlist_hit, Warning, win_powershell_script_block_watchlist_hit: NOTABLE: destructive script block; 1 lines; destructive; matched "remove-item -recurse"; calls "Remove-Item"; targets path_written "C:/Data"; sha256 "774a9a5bfb0940b3536676d349db59df934d857df4fce4e8edde19a18daef7f2"

Example

Creating Scriptblock text (1 of 1): armenc

channel: Microsoft-Windows-PowerShell/Operational
provider_name: Microsoft-Windows-PowerShell
event_id: 4104
event_data.ScriptBlockText: powershell.exe -EncodedCommand SQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuAA==

SparkLogs: win_powershell_script_block_watchlist_hit, Notice, win_powershell_script_block_watchlist_hit: NOTABLE: encoded script block; 1 lines; encoding; matched "-encodedcommand"; obfuscation signals 1; sha256 "bc571380a59ef7eb48126dc15287dd8a0602e7626560cba71f9666c002f2ba46"

Where to look next:

  • Read the matched tokens and the categories to see which rows scored and why.
  • The declared and called names, and any typed targets, say what the block was for.
  • Check whether the block belongs to known automation before treating it as unexpected.

Related reasons:

Matching is text-based and has no PowerShell parser, so a command named inside a comment or a string scores like one that is called. Read the block before drawing a conclusion from the categories alone.

Ask this feed a question​

Every reason code, token and field on this page is queryable across the endpoints you manage. Connect your AI and ask in plain language, or open the same evidence in Explore.