{ "events": [ { "@timestamp": "2020-05-13T09:04:04.755Z", "winlog": { "time_created": "2020-05-13T09:04:04.755Z", "user": { "identifier": "S-1-5-21-2882078887-1352635951-3305458046-1000", "domain": "DESKTOP-6RJHI71", "name": "JohnDoe", "type": "User" }, "activity_id": "{dd68516a-2930-0000-5962-68dd3029d601}", "process": { "pid": 4204, "thread": { "id": 1476 } }, "provider_name": "Microsoft-Windows-PowerShell", "record_id": 790, "computer_name": "vagrant", "version": 1, "event_data": { "ScriptBlockId": "f4a378ab-b74f-41a7-a5ef-6dd55562fdb9", "RunspaceId": "9c031e5c-8d5a-4b91-a12e-b3624970b623" }, "channel": "Microsoft-Windows-PowerShell/Operational", "event_id": "4105", "provider_guid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "level": "verbose" }, "host": { "name": "vagrant" }, "log": { "level": "verbose" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-PowerShell' Guid='{a0c1853b-5c40-4b15-8766-3cf1c58f985a}'/\u003e\u003cEventID\u003e4105\u003c/EventID\u003e\u003cVersion\u003e1\u003c/Version\u003e\u003cLevel\u003e5\u003c/Level\u003e\u003cTask\u003e102\u003c/Task\u003e\u003cOpcode\u003e15\u003c/Opcode\u003e\u003cKeywords\u003e0x0\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2020-05-13T09:04:04.755232500Z'/\u003e\u003cEventRecordID\u003e790\u003c/EventRecordID\u003e\u003cCorrelation ActivityID='{dd68516a-2930-0000-5962-68dd3029d601}'/\u003e\u003cExecution ProcessID='4204' ThreadID='1476'/\u003e\u003cChannel\u003eMicrosoft-Windows-PowerShell/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-21-1350058589-2282154016-2764056528-1000'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='ScriptBlockId'\u003ef4a378ab-b74f-41a7-a5ef-6dd55562fdb9\u003c/Data\u003e\u003cData Name='RunspaceId'\u003e9c031e5c-8d5a-4b91-a12e-b3624970b623\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "4105", "kind": "event", "provider": "Microsoft-Windows-PowerShell" }, "tags": [ "forwarded" ] }, { "@timestamp": "2020-05-15T08:11:47.897Z", "winlog": { "version": 1, "event_data": { "Payload": "CommandInvocation(cmd.exe): \"cmd.exe\"\nCommandInvocation(Out-Null): \"Out-Null\"\nParameterBinding(Out-Null): name=\"InputObject\"; value=\"symbolic link created for C:\\vagrant \u003c\u003c===\u003e\u003e \\\\vboxsvr\\vagrant\"", "ContextInfo": " Severity = Informational\n Host Name = ServerRemoteHost\n Host Version = 1.0.0.0\n Host ID = ed57761b-ba0f-4d11-87d9-fac33820d20e\n Host Application = C:\\Windows\\system32\\wsmprovhost.exe -Embedding\n Engine Version = 5.1.17763.1007\n Runspace ID = 0729459a-8646-4176-8b02-024421a9632e\n Pipeline ID = 1\n Command Name = cmd.exe\n Command Type = Application\n Script Name =\n Command Path = C:\\Windows\\system32\\cmd.exe\n Sequence Number = 34\n User = VAGRANT\\vagrant\n Connected User = VAGRANT\\vagrant\n Shell ID = Microsoft.PowerShell" }, "channel": "Microsoft-Windows-PowerShell/Operational", "event_id": "4103", "record_id": 3885, "computer_name": "vagrant", "provider_guid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "process": { "pid": 3984, "thread": { "id": 3616 } }, "provider_name": "Microsoft-Windows-PowerShell", "time_created": "2020-05-15T08:11:47.897Z", "level": "information", "user": { "identifier": "S-1-5-21-2882078887-1352635951-3305458046-1000", "domain": "DESKTOP-6RJHI71", "name": "JohnDoe", "type": "User" }, "activity_id": "{1aca0717-2acb-0002-c208-ca1acb2ad601}" }, "host": { "name": "vagrant" }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-PowerShell' Guid='{a0c1853b-5c40-4b15-8766-3cf1c58f985a}'/\u003e\u003cEventID\u003e4103\u003c/EventID\u003e\u003cVersion\u003e1\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e106\u003c/Task\u003e\u003cOpcode\u003e20\u003c/Opcode\u003e\u003cKeywords\u003e0x0\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2020-05-15T08:11:47.897949500Z'/\u003e\u003cEventRecordID\u003e3885\u003c/EventRecordID\u003e\u003cCorrelation ActivityID='{1aca0717-2acb-0002-c208-ca1acb2ad601}'/\u003e\u003cExecution ProcessID='3984' ThreadID='3616'/\u003e\u003cChannel\u003eMicrosoft-Windows-PowerShell/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-21-1350058589-2282154016-2764056528-1000'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='ContextInfo'\u003e Severity = Informational\n Host Name = ServerRemoteHost\n Host Version = 1.0.0.0\n Host ID = ed57761b-ba0f-4d11-87d9-fac33820d20e\n Host Application = C:\\Windows\\system32\\wsmprovhost.exe -Embedding\n Engine Version = 5.1.17763.1007\n Runspace ID = 0729459a-8646-4176-8b02-024421a9632e\n Pipeline ID = 1\n Command Name = cmd.exe\n Command Type = Application\n Script Name =\n Command Path = C:\\Windows\\system32\\cmd.exe\n Sequence Number = 34\n User = VAGRANT\\vagrant\n Connected User = VAGRANT\\vagrant\n Shell ID = Microsoft.PowerShell\n\u003c/Data\u003e\u003cData Name='UserData'\u003e\u003c/Data\u003e\u003cData Name='Payload'\u003eCommandInvocation(cmd.exe): \"cmd.exe\"\nCommandInvocation(Out-Null): \"Out-Null\"\nParameterBinding(Out-Null): name=\"InputObject\"; value=\"symbolic link created for C:\\vagrant \u0026lt;\u0026lt;===\u0026gt;\u0026gt; \\\\vboxsvr\\vagrant\"\n\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e\n\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-PowerShell' Guid='{a0c1853b-5c40-4b15-8766-3cf1c58f985a}'/\u003e\u003cEventID\u003e4103\u003c/EventID\u003e\u003cVersion\u003e1\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e106\u003c/Task\u003e\u003cOpcode\u003e20\u003c/Opcode\u003e\u003cKeywords\u003e0x0\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2020-05-15T08:13:06.703293900Z'/\u003e\u003cEventRecordID\u003e3917\u003c/EventRecordID\u003e\u003cCorrelation ActivityID='{1aca0717-2acb-0003-db0b-ca1acb2ad601}'/\u003e\u003cExecution ProcessID='5032' ThreadID='4160'/\u003e\u003cChannel\u003eMicrosoft-Windows-PowerShell/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-21-1350058589-2282154016-2764056528-1000'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='ContextInfo'\u003e Severity = Informational\n Host Name = ConsoleHost\n Host Version = 5.1.17763.1007\n Host ID = aae5217d-054f-435f-9968-4b5bebf12116\n Host Application = C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -noexit -command 'C:\\Gopath\\src\\github.com\\elastic\\beats'\n Engine Version = 5.1.17763.1007\n Runspace ID = a87e8389-57c7-4997-95ff-f82f644965bf\n Pipeline ID = 9\n Command Name = Resolve-Path\n Command Type = Cmdlet\n Script Name =\n Command Path =\n Sequence Number = 22\n User = VAGRANT\\vagrant\n Connected User =\n Shell ID = Microsoft.PowerShell\n\u003c/Data\u003e\u003cData Name='UserData'\u003e\u003c/Data\u003e\u003cData Name='Payload'\u003eCommandInvocation(Resolve-Path): \"Resolve-Path\"\nParameterBinding(Resolve-Path): name=\"ErrorAction\"; value=\"Ignore\"\nParameterBinding(Resolve-Path): name=\"WarningAction\"; value=\"Ignore\"\nParameterBinding(Resolve-Path): name=\"InformationAction\"; value=\"Ignore\"\nParameterBinding(Resolve-Path): name=\"Verbose\"; value=\"False\"\nParameterBinding(Resolve-Path): name=\"Debug\"; value=\"False\"\nParameterBinding(Resolve-Path): name=\"Path\"; value=\"C:\\Gopath\\src\\github.com\\elastic\\beats\\x*\"\n\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "4103", "kind": "event", "provider": "Microsoft-Windows-PowerShell" }, "tags": [ "forwarded" ] }, { "@timestamp": "2020-05-13T10:40:32.595Z", "log": { "level": "verbose" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-PowerShell' Guid='{a0c1853b-5c40-4b15-8766-3cf1c58f985a}'/\u003e\u003cEventID\u003e4106\u003c/EventID\u003e\u003cVersion\u003e1\u003c/Version\u003e\u003cLevel\u003e5\u003c/Level\u003e\u003cTask\u003e103\u003c/Task\u003e\u003cOpcode\u003e15\u003c/Opcode\u003e\u003cKeywords\u003e0x0\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2020-05-13T10:40:32.595715200Z'/\u003e\u003cEventRecordID\u003e933\u003c/EventRecordID\u003e\u003cCorrelation ActivityID='{e3200b8a-290e-0002-332a-20e30e29d601}'/\u003e\u003cExecution ProcessID='4776' ThreadID='5092'/\u003e\u003cChannel\u003eMicrosoft-Windows-PowerShell/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-21-1350058589-2282154016-2764056528-1000'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='ScriptBlockId'\u003e4c487c13-46f7-4485-925b-34855c7e873c\u003c/Data\u003e\u003cData Name='RunspaceId'\u003e3f1a9181-0523-4645-a42c-2c1868c39332\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "4106", "kind": "event", "provider": "Microsoft-Windows-PowerShell" }, "tags": [ "forwarded" ], "winlog": { "user": { "identifier": "S-1-5-21-2882078887-1352635951-3305458046-1000", "domain": "DESKTOP-6RJHI71", "name": "JohnDoe", "type": "User" }, "activity_id": "{e3200b8a-290e-0002-332a-20e30e29d601}", "channel": "Microsoft-Windows-PowerShell/Operational", "event_id": "4106", "provider_name": "Microsoft-Windows-PowerShell", "record_id": 933, "version": 1, "level": "verbose", "computer_name": "vagrant", "provider_guid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "time_created": "2020-05-13T10:40:32.595Z", "event_data": { "ScriptBlockId": "4c487c13-46f7-4485-925b-34855c7e873c", "RunspaceId": "3f1a9181-0523-4645-a42c-2c1868c39332" }, "process": { "pid": 4776, "thread": { "id": 5092 } } }, "host": { "name": "vagrant" } }, { "@timestamp": "2020-05-14T11:33:51.389Z", "log": { "level": "verbose" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-PowerShell' Guid='{a0c1853b-5c40-4b15-8766-3cf1c58f985a}'/\u003e\u003cEventID\u003e4104\u003c/EventID\u003e\u003cVersion\u003e1\u003c/Version\u003e\u003cLevel\u003e5\u003c/Level\u003e\u003cTask\u003e2\u003c/Task\u003e\u003cOpcode\u003e15\u003c/Opcode\u003e\u003cKeywords\u003e0x0\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2020-05-14T11:33:51.389266200Z'/\u003e\u003cEventRecordID\u003e3580\u003c/EventRecordID\u003e\u003cCorrelation ActivityID='{fb13c9de-29f7-0001-18e0-13fbf729d601}'/\u003e\u003cExecution ProcessID='4844' ThreadID='4428'/\u003e\u003cChannel\u003eMicrosoft-Windows-PowerShell/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-21-1350058589-2282154016-2764056528-1000'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='MessageNumber'\u003e1\u003c/Data\u003e\u003cData Name='MessageTotal'\u003e1\u003c/Data\u003e\u003cData Name='ScriptBlockText'\u003e.\\patata.ps1\u003c/Data\u003e\u003cData Name='ScriptBlockId'\u003e50d2dbda-7361-4926-a94d-d9eadfdb43fa\u003c/Data\u003e\u003cData Name='Path'\u003e\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e\n\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-PowerShell' Guid='{a0c1853b-5c40-4b15-8766-3cf1c58f985a}'/\u003e\u003cEventID\u003e4104\u003c/EventID\u003e\u003cVersion\u003e1\u003c/Version\u003e\u003cLevel\u003e5\u003c/Level\u003e\u003cTask\u003e2\u003c/Task\u003e\u003cOpcode\u003e15\u003c/Opcode\u003e\u003cKeywords\u003e0x0\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2020-05-14T11:33:51.393884800Z'/\u003e\u003cEventRecordID\u003e3582\u003c/EventRecordID\u003e\u003cCorrelation ActivityID='{fb13c9de-29f7-0000-79db-13fbf729d601}'/\u003e\u003cExecution ProcessID='4844' ThreadID='4428'/\u003e\u003cChannel\u003eMicrosoft-Windows-PowerShell/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-21-1350058589-2282154016-2764056528-1000'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='MessageNumber'\u003e1\u003c/Data\u003e\u003cData Name='MessageTotal'\u003e1\u003c/Data\u003e\u003cData Name='ScriptBlockText'\u003e\u003c/Data\u003e\u003cData Name='ScriptBlockId'\u003ef5521cbd-656e-4296-b74d-9ffb4eec23b0\u003c/Data\u003e\u003cData Name='Path'\u003eC:\\Users\\vagrant\\Desktop\\patata.ps1\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "4104", "kind": "event", "provider": "Microsoft-Windows-PowerShell" }, "tags": [ "forwarded" ], "winlog": { "level": "verbose", "event_data": { "MessageNumber": "1", "MessageTotal": "1", "ScriptBlockText": "###\n# ==++==\n#\n# Copyright (c) Microsoft Corporation. All rights reserved.\n# Licensed under the Apache License, Version 2.0 (the \"License\");\n# you may not use this file except in compliance with the License.\n# You may obtain a copy of the License at\n# http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS,\n# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n# See the License for the specific language governing permissions and\n# limitations under the License.\n#\n###\n@{\n GUID = \"4ae9fd46-338a-459c-8186-07f910774cb8\"\n Author = \"Microsoft Corporation\"\n CompanyName = \"Microsoft Corporation\"\n Copyright = \"(C) Microsoft Corporation. All rights reserved.\"\n HelpInfoUri = \"https://go.microsoft.com/fwlink/?linkid=2113634\"\n ModuleVersion = \"1.4.8.1\"\n PowerShellVersion = \"3.0\"\n ClrVersion = \"4.0\"\n RootModule = \"PackageManagement.psm1\"\n\tDescription = 'PackageManagement (a.k.a. OneGet) is a new way to discover and install software packages from around the web.\n It is a manager or multiplexor of existing package managers (also called package providers) that unifies Windows package management with a single Windows PowerShell interface. With PackageManagement, you can do the following.\n - Manage a list of software repositories in which packages can be searched, acquired and installed\n - Discover software packages\n - Seamlessly install, uninstall, and inventory packages from one or more software repositories'\n\n CmdletsToExport = @(\n 'Find-Package',\n 'Get-Package',\n 'Get-PackageProvider',\n 'Get-PackageSource',\n 'Install-Package',\n 'Import-PackageProvider'\n 'Find-PackageProvider'\n 'Install-PackageProvider'\n 'Register-PackageSource',\n 'Set-PackageSource',\n 'Unregister-PackageSource',\n 'Uninstall-Package'\n 'Save-Package'\n\t)\n\n\tFormatsToProcess = @('PackageManagement.format.ps1xml')\n\n\tPrivateData = @{\n PSData = @{\n Tags = @('PackageManagement', 'PSEdition_Core', 'PSEdition_Desktop', 'Linux', 'Mac')\n ProjectUri = 'https://oneget.org'\n ReleaseNotes = @'\n## 1.4.8.1\n- Update PackageManagement's strong name signing\n\n## 1.4.8\n- Add NuGet as a source when generating nuget.config file for user in the NuGet Provider\n\n## 1.4.7\n- Update security protocol to use TLS 1.2\n- Remove catalog file\n\n## 1.4.6\n- Update `HelpInfoUri` to point to the latest content\n\n## 1.4.5\n- Bug fix for deadlock when getting parameters in an event\n\n## 1.4.4\n- Bug fix when installing modules from private feeds\n\n ## 1.4.3\n- Another bug fix when registering repositories with PowerShellGet\n\n## 1.4.2\n- Bug fix for passing credentials from PowerShellGet when registering repositories\n\n## 1.4.1\n- Bug fix for using credential provider installed in Visual Studio\n\n## 1.4\n- Allow credential persistance for registering private repositories and finding or installing packages from those repositories\n\n## 1.3.2\n- Enable bootstrap on PSCore\n- Bug fix to run on .NET Core 3.0\n\n## 1.3.1\n- Targets net452 and netstandard2.0 instead of net451, netcoreapp2.0, and netstandard1.6\n \n## Previous releases are not included in this Changelog\n'@\n }\n }\n}\n\n# SIG # Begin signature block\n# MIInoQYJKoZIhvcNAQcCoIInkjCCJ44CAQExDzANBglghkgBZQMEAgEFADB5Bgor\n# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG\n# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCANw97w1D+bi5LY\n# 8ZEuubcA0tI0Z0h+CImFRYop+IIqQaCCDYEwggX/MIID56ADAgECAhMzAAACUosz\n# qviV8znbAAAAAAJSMA0GCSqGSIb3DQEBCwUAMH4xCzAJBgNVBAYTAlVTMRMwEQYD\n# +nC4D7IMA1+6smM7fbSJa7o4BHfyje8PHB3w9GF223mZTG0EhBlultQkMSpV/c88\n# 9hsbwx16Cr5sY9M/lSRt4oC3qzSuTmYd6VYJ/ILt9ptrpOkaYCiXXRx8Cfz7w53w\n# Au/J8xJjNWvrKxkcc8XiUXPfGGTXujyiS2MqvztBkg6wCduFKqogmvOtQiiwQQxE\n# G6lU/rss27omoTUc41EawOr1km5y+fUS9aoYX9K8NNhFH6TSni3dp/+Hiyif1T7X\n# g0cBy4yHuYxMmRrFcmGeplW3KhXHfkJjbHaVs1QgnRfkgFuypwF5YoFWrW7Xgj+a\n# ZCDKSoYq45E4v0ryIvyu0shBoHQXREAzpBv3L9h5A9vEFQG4alCI57oSbdqJ1YIa\n# ggkTQHR2CWdB7FnQilCqqZjSnAtXYZh/RD+PX6fg1UyUUQf5ohnw951pQeKYTYHm\n# Fwut+RibzdbHEF/kLZr6SZsDupCv\n# SIG # End signature block", "ScriptBlockId": "50d2dbda-7361-4926-a94d-d9eadfdb43fa" }, "provider_name": "Microsoft-Windows-PowerShell", "version": 1, "record_id": 3580, "computer_name": "vagrant", "provider_guid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "time_created": "2020-05-14T11:33:51.389Z", "user": { "identifier": "S-1-5-21-2882078887-1352635951-3305458046-1000", "domain": "DESKTOP-6RJHI71", "name": "JohnDoe", "type": "User" }, "activity_id": "{fb13c9de-29f7-0001-18e0-13fbf729d601}", "channel": "Microsoft-Windows-PowerShell/Operational", "event_id": "4104", "process": { "thread": { "id": 4428 }, "pid": 4844 } }, "host": { "name": "vagrant" } }, { "@timestamp": "2024-07-10T18:28:55.469Z", "log": { "level": "verbose" }, "event": { "code": "4104", "kind": "event", "provider": "Microsoft-Windows-PowerShell" }, "tags": [ "forwarded" ], "winlog": { "level": "verbose", "event_data": { "MessageNumber": "1", "MessageTotal": "1", "ScriptBlockText": "$DumpFilePath = $PWD\n$WER = [PSObject].Assembly.GetType(((\"{0}{1}\" -f'Sy','st')+(\"{0}{1}\" -f 'em','.M')+'ana'+(\"{1}{0}\" -f 'e','gem')+(\"{0}{1}\"-f 'n',(\"{0}{2}{1}\" -f't.','ma','Auto'))+'ti'+(\"{1}{0}{2}\" -f(\"{2}{0}{1}\" -f 'W','indow','n.'),'o','s')+'E'+'rro'+(\"{0}{1}{2}\"-f'r',(\"{0}{1}\" -f'Rep','o'),'rt')+'ing'))\n$WERNativeMethods = $WER.GetNestedType(('Na'+'tiv'+(\"{0}{2}{1}\" -f 'e','s',(\"{1}{0}\" -f'od','Meth'))), ('Non'+'Pu'+(\"{0}{1}\" -f'bl','ic')))\n$Flags = [Reflection.BindingFlags] ((\"{1}{0}\"-f'P','Non')+(\"{1}{0}\"-f 'li','ub')+'c'+(\"{0}{1}\"-f(\"{1}{0}\" -f'ta',', S'),'tic'))\n$MiniDumpWriteDump = $WERNativeMethods.GetMethod(((\"{0}{1}\"-f'Min','i')+(\"{1}{2}{0}\"-f(\"{0}{1}\" -f'p','Write'),'Du','m')+'D'+'u'+'m'+'p'), $Flags)\n$MiniDumpWithFullMemory = [UInt32] 2\n$la = 'ls'\n$ss = ('a'+'ss')\n$Process = Get-Process $la$ss\n$ProcessId = $Process.Id\n$ProcessName = $Process.Name\n$ProcessHandle = $Process.Handle\n$ProcessFileName = \"$($ProcessName)_$($ProcessId).dmp\"\n$ProcessDumpPath = Join-Path $DumpFilePath $ProcessFileName\n$FileStream = New-Object IO.FileStream($ProcessDumpPath, [IO.FileMode]::Create)\n$Result = $MiniDumpWriteDump.Invoke($null, @($ProcessHandle,\n $ProcessId,\n $FileStream.SafeFileHandle,\n $MiniDumpWithFullMemory,\n [IntPtr]::Zero,\n [IntPtr]::Zero,\n [IntPtr]::Zero))\n$FileStream.Close()\nGet-ChildItem $ProcessDumpPath", "ScriptBlockId": "d5325f44-dfca-48a1-aa4f-9bfee88c3d48" }, "provider_name": "Microsoft-Windows-PowerShell", "version": 1, "record_id": 3944, "computer_name": "kingslanding.sevenkingdoms.local", "provider_guid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "user": { "identifier": "S-1-5-21-3715621034-4113696668-281506975-1117" }, "activity_id": "{fb13c9de-29f7-0001-18e0-13fbf729d601}", "channel": "Microsoft-Windows-PowerShell/Operational", "event_id": "4104", "process": { "thread": { "id": 11556 }, "pid": 4696 } }, "host": { "name": "kingslanding" } }, { "@timestamp": "2023-06-01T05:27:01.247Z", "event": { "action": "Executing Pipeline", "code": "4103", "kind": "event", "provider": "Microsoft-Windows-PowerShell" }, "host": { "name": "host.contoso.com" }, "log": { "level": "information" }, "message": "CommandInvocation(Get-ItemProperty): \"Get-ItemProperty\"\nParameterBinding(Get-ItemProperty): name=\"Path\"; value=\"hklm:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\"\nParameterBinding(Get-ItemProperty): name=\"Name\"; value=\"Authentication Packages\"\nCommandInvocation(Select-Object): \"Select-Object\"\nParameterBinding(Select-Object): name=\"ExpandProperty\"; value=\"Authentication Packages\"\nParameterBinding(Select-Object): name=\"InputObject\"; value=\"@{Authentication Packages=System.String[]; PSPath=Microsoft.PowerShell.Core\\Registry::HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa; PSParentPath=Microsoft.PowerShell.Core\\Registry::HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control; PSChildName=Lsa; PSDrive=HKLM; PSProvider=Microsoft.PowerShell.Core\\Registry}\"\n\n\nContext:\n Severity = Informational\n Host Name = OpsMgr PowerShell Host\n Host Version = 7.0.5000.0\n Host ID = b0c2607f-a734-4f24-8f75-fb6e7b79d116\n Host Application = C:\\Program Files\\Microsoft Monitoring Agent\\Agent\\MonitoringHost.exe -Embedding\n Engine Version = 5.1.17763.3770\n Runspace ID = 860aba3e-ecbc-48d8-beaa-b5c19b845dfb\n Pipeline ID = 2\n Command Name = Get-ItemProperty\n Command Type = Cmdlet\n Script Name = \n Command Path = \n Sequence Number = 7213\n User = CONTOSO\\SYSTEM\n Connected User = \n Shell ID = Microsoft.PowerShell\n\n\nUser Data:", "winlog": { "activity_id": "{a5ce6d2b-8964-4ec4-b0a3-1e749f8aa4ad}", "channel": "Microsoft-Windows-PowerShell/Operational", "computer_name": "host.contoso.com", "event_data": { "ContextInfo": " Severity = Informational\n Host Name = OpsMgr PowerShell Host\n Host Version = 7.0.5000.0\n Host ID = 1c251f62-545d-4d71-901e-b3445e459c2c\n Host Application = C:\\Program Files\\Microsoft Monitoring Agent\\Agent\\MonitoringHost.exe -Embedding\n Engine Version = 5.1.17763.3770\n Runspace ID = 9f8ee3e6-561c-4875-a882-a352509348b8\n Pipeline ID = 2\n Command Name = Get-ItemProperty\n Command Type = Cmdlet\n Script Name = \n Command Path = \n Sequence Number = 7216833\n User = CONTOSO\\SYSTEM\n Connected User = \n Shell ID = Microsoft.PowerShell", "Payload": "CommandInvocation(Get-ItemProperty): \"Get-ItemProperty\"\nParameterBinding(Get-ItemProperty): name=\"Path\"; value=\"hklm:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\"\nParameterBinding(Get-ItemProperty): name=\"Name\"; value=\"Authentication Packages\"\nCommandInvocation(Select-Object): \"Select-Object\"\nParameterBinding(Select-Object): name=\"ExpandProperty\"; value=\"Authentication Packages\"\nParameterBinding(Select-Object): name=\"InputObject\"; value=\"@{Authentication Packages=System.String[]; PSPath=Microsoft.PowerShell.Core\\Registry::HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa; PSParentPath=Microsoft.PowerShell.Core\\Registry::HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control; PSChildName=Lsa; PSDrive=HKLM; PSProvider=Microsoft.PowerShell.Core\\Registry}\"" }, "event_id": "4103", "level": "information", "opcode": "To be used when operation is just executing a method", "process": { "pid": 2349, "thread": { "id": 32444 } }, "provider_guid": "{92a98569-96ac-46a7-af87-1eba79f456ee}", "provider_name": "Microsoft-Windows-PowerShell", "record_id": 5663677, "task": "Executing Pipeline", "time_created": "2023-06-01T05:27:01.2479769Z", "user": { "identifier": "S-1-5-21-2882078887-1352635951-3305458046-1000", "domain": "DESKTOP-6RJHI71", "name": "JohnDoe", "type": "User" }, "version": 1 } }, { "@timestamp": "2026-08-12T19:59:05.266Z", "winlog": { "version": 1, "event_data": { "Payload": "CommandInvocation(Out-Default): \"Out-Default\"\nParameterBinding(Out-Default): name=\"InputObject\"; value=\"alpha\"\nParameterBinding(Out-Default): name=\"InputObject\"; value=\"bravo\"\nParameterBinding(Out-Default): name=\"InputObject\"; value=\"charlie\"\nParameterBinding(Out-Default): name=\"InputObject\"; value=\"many items\"\nParameterBinding(Out-Default): name=\"InputObject\"; value=\"SDH7437C-REPRO-MARKER\"\n", "ContextInfo": " Severity = Informational\n Host Name = ConsoleHost\n Host Version = 5.1.20348.5386\n Host ID = 7099cc11-f00b-4234-b432-73d3baa3d8de\n Host Application = C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -NoProfile -NonInteractive -Command $marker = 'SDH7437C-REPRO-MARKER'\n$items = @(\n 'alpha',\n 'bravo',\n 'charlie'\n)\n$count = 0\nforeach ($i in $items) {\n # walk the list, no colon and no equals on this line\n Write-Output $i\n $count++\n}\nif ($count -gt 2) {\n Write-Output 'many items'\n} else {\n Write-Output 'few items'\n}\ntry {\n Get-Random -Maximum 10 | Out-Null\n} catch {\n Write-Output 'no random available'\n}\nWrite-Output $marker\n Engine Version = 5.1.20348.5386\n Runspace ID = 5f75a73b-dbb3-4342-b743-93c99a117c09\n Pipeline ID = 1\n Command Name = \n Command Type = Script\n Script Name = \n Command Path = \n Sequence Number = 28\n User = DEVUSER-WIN-SDH\\user\n Connected User = \n Shell ID = Microsoft.PowerShell\n" }, "channel": "Microsoft-Windows-PowerShell/Operational", "event_id": "4103", "record_id": 2158, "computer_name": "DEVUSER-WIN-SDH", "provider_guid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "process": { "pid": 5712, "thread": { "id": 5948 } }, "provider_name": "Microsoft-Windows-PowerShell", "time_created": "2026-08-12T19:59:05.266Z", "level": "information", "user": { "identifier": "S-1-5-21-1111111111-2222222222-3333333333-1000", "domain": "DEVUSER-WIN-SDH", "name": "user", "type": "User" }, "activity_id": "{75d3d869-61a5-0003-af60-295d942add01}" }, "host": { "name": "DEVUSER-WIN-SDH" }, "log": { "level": "information" }, "event": { "original": "410314106200x02158Microsoft-Windows-PowerShell/OperationalDEVUSER-WIN-SDH Severity = Informational\n Host Name = ConsoleHost\n Host Version = 5.1.20348.5386\n Host ID = 7099cc11-f00b-4234-b432-73d3baa3d8de\n Host Application = C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -NoProfile -NonInteractive -Command $marker = 'SDH7437C-REPRO-MARKER'\n$items = @(\n 'alpha',\n 'bravo',\n 'charlie'\n)\n$count = 0\nforeach ($i in $items) {\n # walk the list, no colon and no equals on this line\n Write-Output $i\n $count++\n}\nif ($count -gt 2) {\n Write-Output 'many items'\n} else {\n Write-Output 'few items'\n}\ntry {\n Get-Random -Maximum 10 | Out-Null\n} catch {\n Write-Output 'no random available'\n}\nWrite-Output $marker\n Engine Version = 5.1.20348.5386\n Runspace ID = 5f75a73b-dbb3-4342-b743-93c99a117c09\n Pipeline ID = 1\n Command Name = \n Command Type = Script\n Script Name = \n Command Path = \n Sequence Number = 28\n User = DEVUSER-WIN-SDH\\user\n Connected User = \n Shell ID = Microsoft.PowerShell\nCommandInvocation(Out-Default): \"Out-Default\"\nParameterBinding(Out-Default): name=\"InputObject\"; value=\"alpha\"\nParameterBinding(Out-Default): name=\"InputObject\"; value=\"bravo\"\nParameterBinding(Out-Default): name=\"InputObject\"; value=\"charlie\"\nParameterBinding(Out-Default): name=\"InputObject\"; value=\"many items\"\nParameterBinding(Out-Default): name=\"InputObject\"; value=\"SDH7437C-REPRO-MARKER\"\n", "code": "4103", "kind": "event", "provider": "Microsoft-Windows-PowerShell" }, "tags": [ "forwarded" ] }, { "@timestamp": "2023-01-18T10:15:42.123Z", "winlog": { "version": 1, "event_data": { "Payload": "CommandInvocation(Get-Date): \"Get-Date\"", "ContextInfo": " Gravedad = Informational\n Nombre de host = ConsoleHost\n Versión de host = 5.1.19041.1320\n Id. de host = 56995afd-2444-424e-871c-4c5513731a3b\n Aplicación host = C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\n Id. de espacio de ejecución = fc8f1c5e-3b52-4d0e-9f3a-6c1d2e7b8a90\n Id. de canalización = 1\n Usuario conectado = \n Id. de shell = Microsoft.PowerShell" }, "channel": "Microsoft-Windows-PowerShell/Operational", "event_id": "4103", "record_id": 4211, "computer_name": "ES-HOST", "provider_guid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "process": { "pid": 6120, "thread": { "id": 6244 } }, "provider_name": "Microsoft-Windows-PowerShell", "time_created": "2023-01-18T10:15:42.123Z", "level": "information", "user": { "identifier": "S-1-5-21-4444444444-5555555555-6666666666-1001", "domain": "ES-HOST", "name": "usuario", "type": "User" }, "activity_id": "{3b9f3d24-5a0c-0001-8e2b-9f3b0c5ad901}" }, "host": { "name": "ES-HOST" }, "log": { "level": "information" }, "event": { "code": "4103", "kind": "event", "provider": "Microsoft-Windows-PowerShell" }, "tags": [ "forwarded" ] }, { "@timestamp": "2024-11-05T14:02:11.555Z", "winlog": { "version": 1, "event_data": { "Payload": "CommandInvocation(Write-Output): \"Write-Output\"\nParameterBinding(Write-Output): name=\"InputObject\"; value=\"example\"", "ContextInfo": " Severity = Informational\n Host Name = ConsoleHost\n Host Version = 5.1.19041.4648\n Host ID = 3f1c2a9e-7b4d-4e8a-9c61-2d5e8f0a1b37\n Host Application = C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -NoProfile -Command $config = @{\n Outer = @{\n Name = 'example'\n Enabled = $true\n }\n}\n Host Application = C:\\Windows\\System32\\notepad.exe\nWrite-Output $config.Outer.Name\n Engine Version = 5.1.19041.4648\n Runspace ID = 8d2e4b61-0c3f-4a7e-b9d2-5f1a6c3e7b90\n Pipeline ID = 1\n Command Name = Write-Output\n Command Type = Cmdlet\n Script Name = \n Command Path = \n Sequence Number = 22\n User = WIN-TEST\\tester\n Connected User = \n Shell ID = Microsoft.PowerShell" }, "channel": "Microsoft-Windows-PowerShell/Operational", "event_id": "4103", "record_id": 7731, "computer_name": "WIN-TEST", "provider_guid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "process": { "pid": 4410, "thread": { "id": 4522 } }, "provider_name": "Microsoft-Windows-PowerShell", "time_created": "2024-11-05T14:02:11.555Z", "level": "information", "user": { "identifier": "S-1-5-21-7777777777-8888888888-9999999999-1002", "domain": "WIN-TEST", "name": "tester", "type": "User" }, "activity_id": "{6e2b9a10-3c4d-0002-91f2-7a6b5c4d3e21}" }, "host": { "name": "WIN-TEST" }, "log": { "level": "information" }, "event": { "code": "4103", "kind": "event", "provider": "Microsoft-Windows-PowerShell" }, "tags": [ "forwarded" ] }, { "@timestamp": "2024-11-06T09:30:27.987Z", "winlog": { "version": 1, "event_data": { "Payload": "CommandInvocation(Get-Date): \"Get-Date\"", "ContextInfo": " Gravité = Informational\n Nom d’hôte = ConsoleHost\n Version de l’hôte = 5.1.19041.4648\n ID d’hôte = a0925d75-baf4-4609-b69b-8d14a9f85b42\n Application hôte = C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\n Version du moteur = 5.1.19041.4648\n ID d’instance d’exécution = 4b7d9e2a-1c3f-4e5a-8b6d-0f2e4a6c8d10\n ID de pipeline = 1\n Nom de commande = Get-Date\n Type de commande = Cmdlet\n Nom du script = \n Chemin de la commande = \n Numéro de séquence = 18\n Utilisateur = POSTE-FR\\utilisateur\n Utilisateur connecté = \n ID d’interpréteur de commandes = Microsoft.PowerShell" }, "channel": "Microsoft-Windows-PowerShell/Operational", "event_id": "4103", "record_id": 1290, "computer_name": "POSTE-FR", "provider_guid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}", "process": { "pid": 3388, "thread": { "id": 3412 } }, "provider_name": "Microsoft-Windows-PowerShell", "time_created": "2024-11-06T09:30:27.987Z", "level": "information", "user": { "identifier": "S-1-5-21-1212121212-3434343434-5656565656-1001", "domain": "POSTE-FR", "name": "utilisateur", "type": "User" }, "activity_id": "{1f4e7c2a-9b3d-0001-6a5e-4c3b2a190f87}" }, "host": { "name": "POSTE-FR" }, "log": { "level": "information" }, "event": { "code": "4103", "kind": "event", "provider": "Microsoft-Windows-PowerShell" }, "tags": [ "forwarded" ] } ] }