---
title: "Microsoft Windows PowerShell Integration"
slug: "microsoft-windows-powershell"
updated: 2026-11-02T22:48:01Z
published: 2026-11-02T22:48:01Z
canonical: "docs.hunters.ai/microsoft-windows-powershell"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Windows PowerShell Integration

## TL;DR

| Supported data types | 3rd party detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Windows PowerShell Script Block Logging (Event ID 4104) |  | ✅ | ✅ | ✅ | `microsoft_windows_powershell_scriptblock` | nested-json-xml | S3 |

## Overview

Windows PowerShell Script Block Logging captures the full content of PowerShell commands, scripts, and functions as they are executed on a Windows host, regardless of whether they were invoked interactively or via automation. These events are recorded under the Microsoft-Windows-PowerShell/Operational event log channel as Event ID 4104, and contain the decoded script block text, a unique script block identifier, and the originating script path when available. For security operations, these logs are a critical detection and forensic source for identifying malicious or obfuscated PowerShell activity, living-off-the-land attacks, fileless malware, and post-exploitation tooling, since they expose the actual code executed rather than just the invocation command line. Ingesting this data into Hunters enables correlation of PowerShell execution activity with other telemetry sources to surface suspicious scripting behavior across the environment.

## Supported data types

### Windows PowerShell Script Block Logging (Event ID 4104)

**Table name:** `microsoft_windows_powershell_scriptblock`

This data type contains the raw script block text executed by PowerShell on Windows hosts, along with metadata such as the script block ID, process and thread identifiers, the originating script path, and the host on which execution occurred. It covers security-relevant PowerShell activity including multi-part script blocks, obfuscated code, and scripts executed via remoting or automation, making it a key source for detecting living-off-the-land attacks and fileless malware.

**Expected format**

Logs are expected in nested-json-xml format.

`{"_time":1793057666.184,"_raw":"<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-PowerShell' Guid='{f1a2b3c4-1111-2222-3333-444455556666}'/><EventID>4104</EventID><Version>1</Version><Level>5</Level><Task>2</Task><Opcode>15</Opcode><Keywords>0x0</Keywords><TimeCreated SystemTime='2026-10-26T23:34:26.1845820Z'/><EventRecordID>1779630755</EventRecordID><Correlation ActivityID='{c2b3d4e5-6677-0000-44cc-55dd66ee7700}'/><Execution ProcessID='6632' ThreadID='2420'/><Channel>Microsoft-Windows-PowerShell/Operational</Channel><Computer>host-srv-01.example.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='MessageNumber'>1</Data><Data Name='MessageTotal'>1</Data><Data Name='ScriptBlockText'>Get-PSDrive -PSProvider 'FileSystem' | Select-Object * -ExcludeProperty Provider,Credential,CurrentLocation | ConvertTo-Json -Depth 100 -Compress</Data><Data Name='ScriptBlockId'>f31af2d9-8f1a-4d1a-9250-e24367d591c5</Data><Data Name='Path'></Data></EventData><RenderingInfo Culture='en-US'><Message>Creating Scriptblock text (1 of 1):\r\nGet-PSDrive -PSProvider 'FileSystem' | Select-Object * -ExcludeProperty Provider,Credential,CurrentLocation | ConvertTo-Json -Depth 100 -Compress\r\n\r\nScriptBlock ID: f31af2d9-8f1a-4d1a-9250-e24367d591c5\r\nPath: </Message><Level>Verbose</Level><Task>Execute a Remote Command</Task><Opcode>On create calls</Opcode><Channel>Microsoft-Windows-PowerShell/Operational</Channel></RenderingInfo></Event>","source":"Supercharger-Destination-ProdPowershellOps/Log","host":"wec-collector-02"}`

## Send data to Hunters

Hunters supports the collection of Microsoft Windows PowerShell logs using S3 List.

**To connect Microsoft Windows PowerShell logs:**

1. Route Microsoft Windows PowerShell logs into an AWS S3 bucket.
2. Once logs are in S3, follow the steps in [this section](https://docs.hunters.ai/docs/connect-data-through-aws-s3).