PowerShell execution tracking events
In addition to Event ID 4688, which logs the execution of a PowerShell process, along with its command-line argument, Microsoft records several event logs that allow you to track PowerShell activities. Some of those event logs are generated by all PowerShell versions and some of them are just generated when specific PowerShell versions are installed. In this section, we will discuss three event logs that are valuable for investigating and tracking suspicious PowerShell execution activities. These events exist in two PowerShell event files – Event ID 800 exists in the Windows PowerShell Event Log file and Event IDs 4103 and 4104 exist in the Microsoft-Windows-PowerShell/Operational event log file.
From PowerShell version 5 onward, Microsoft has provided a new logging feature to log entire executed PowerShell script blocks. By default, the script block logging feature is disabled, but it automatically logs any suspicious script execution...
