PowerShell

Kind

Event - something that happened at a time

Its time is

event logged

Built-in rules reading it

16

powershell.script_text

string

The text PowerShell ran: a script block (4104) - a command typed, a script file, or code a script built and ran - or a command in a user's PowerShell history file. A long block is recorded in parts (powershell.script_part), each matched on its own: a pattern split across two parts is not found.

powershell.script_block_id

string

The script block's ID: every part of one block carries the same.

powershell.script_part

string

Which part of its script block a record is, "n of m" - absent for a block recorded whole.

powershell.script_path

string

The script file the block came from; absent for a command typed or code built at run time.

powershell.flagged

bool

Whether PowerShell's own check found the block suspicious (it then records it as a warning, whether or not Script Block Logging is on). The check reacts to words that administrative scripts use too; it is a hint, not a verdict.
derived: read by Signal from the record's level (warning)

powershell.obfuscation

string

How likely the text was written to be unreadable - medium (two of the measured indicators) or high (three or more); absent below. Measured, not matched on a word: the indicators are counts over the text (powershell.obfuscation_indicators). A packed or generated script can reach it without being malicious.
derived: measured by Signal over powershell.script_text

powershell.obfuscation_indicators

string

The indicators the obfuscation measure found, each with its count: backticks inside names, strings joined piece by piece, a long encoded run, a share of quotes, brackets and operators far above code's.
derived: measured by Signal over powershell.script_text

account.sid

string

The account's SID - its identity across renames and hosts (a domain account has the same SID everywhere). Timeless, unlike process.pid, so it needs no companion time; the evidence types that carry it name their instances by it (evidence.Type.Identity).

account.kind

string

What the account is: person, default (a local account Windows creates), service, virtual, anonymous, group or computer.
derived: decided by Signal from the account's SID (its name only when there is no SID)

Kind

Event - something that happened at a time

Its time is

event logged

Built-in rules reading it

1

powershell.engine_version

string

The version of the PowerShell engine that started (Windows PowerShell 400) - 2.0 is the engine that has no Script Block Logging and no AMSI.

powershell.host_application

string

The program, with its command line, that started the PowerShell engine (Windows PowerShell 400) - recorded whatever the 4688 command-line policy.

powershell.host_name

string

The PowerShell host the engine started in: ConsoleHost (a console), ServerRemoteHost (a remote session), or the name another program gives its own host.

Kind

State - something true when Signal read the host

Its time is

history file last written (the command's own time is not recorded)

Built-in rules reading it

16

powershell.script_text

string

The text PowerShell ran: a script block (4104) - a command typed, a script file, or code a script built and ran - or a command in a user's PowerShell history file. A long block is recorded in parts (powershell.script_part), each matched on its own: a pattern split across two parts is not found.

powershell.history_file

string

The PowerShell history file a command was read from (PSReadLine's <host>_history.txt in a user's profile - one per PowerShell host, shared by Windows PowerShell and PowerShell 7).

powershell.history_created

time

When the command's history file was created: the earliest the command can have been typed - unless the file was copied, recreated or its times changed.

powershell.obfuscation

string

How likely the text was written to be unreadable - medium (two of the measured indicators) or high (three or more); absent below. Measured, not matched on a word: the indicators are counts over the text (powershell.obfuscation_indicators). A packed or generated script can reach it without being malicious.
derived: measured by Signal over powershell.script_text

powershell.obfuscation_indicators

string

The indicators the obfuscation measure found, each with its count: backticks inside names, strings joined piece by piece, a long encoded run, a share of quotes, brackets and operators far above code's.
derived: measured by Signal over powershell.script_text

account.sid

string

The account's SID - its identity across renames and hosts (a domain account has the same SID everywhere). Timeless, unlike process.pid, so it needs no companion time; the evidence types that carry it name their instances by it (evidence.Type.Identity).

account.kind

string

What the account is: person, default (a local account Windows creates), service, virtual, anonymous, group or computer.
derived: decided by Signal from the account's SID (its name only when there is no SID)

Kind

State - something true when Signal read the host

Its time is

command started (transcript header)

Built-in rules reading it

16

powershell.script_text

string

The text PowerShell ran: a script block (4104) - a command typed, a script file, or code a script built and ran - or a command in a user's PowerShell history file. A long block is recorded in parts (powershell.script_part), each matched on its own: a pattern split across two parts is not found.

powershell.transcript_file

string

The transcript file a command was read from (PowerShell_transcript.<computer>.<random>.<time>.txt - in the policy's output folder, else in the user's Documents under a folder per day).

powershell.transcript_user

string

The account the transcript's header names (Username), and the account the session ran as when it differs (RunAs User) - as the session wrote them into its own file.

powershell.host_application

string

The program, with its command line, that started the PowerShell engine (Windows PowerShell 400) - recorded whatever the 4688 command-line policy.

powershell.obfuscation

string

How likely the text was written to be unreadable - medium (two of the measured indicators) or high (three or more); absent below. Measured, not matched on a word: the indicators are counts over the text (powershell.obfuscation_indicators). A packed or generated script can reach it without being malicious.
derived: measured by Signal over powershell.script_text

powershell.obfuscation_indicators

string

The indicators the obfuscation measure found, each with its count: backticks inside names, strings joined piece by piece, a long encoded run, a share of quotes, brackets and operators far above code's.
derived: measured by Signal over powershell.script_text