Log sources › WinEventLog:PowerShell

WinEventLog:PowerShell

Inverted view: what can be detected if this is the log you have. Office Suite, Windows

channels

analytics

techniques

KEV CVEs reachable

"Reachable" means: a KEV CVE has a public mapping to a technique, and MITRE's analytic for that technique names this log source. It is a statement about published knowledge, not about whether any particular rule fires.

Channels

Channel	Data components	Analytics	Techniques
`CmdletName: Get-Recipient, Get-User`	DC0064 Command Execution	AN1089	1
`CommandLine=copy-item or robocopy from UNC path`	DC0064 Command Execution	AN0194	1
`EventCode=400, 403`	DC0034 Process Metadata	AN1252	1
`EventCode=4103, 4104, 4105, 4106`	DC0029 Script Execution DC0064 Command Execution	AN0037 AN0089 AN0131 AN0152 AN0182 AN0254 AN0271 AN0274 AN0286 AN0345 AN0363 AN0388 AN0392 AN0430 AN0455 AN0469 AN0472 AN0507 AN0513 AN0551 AN0559 AN0589 AN0622 AN0641 AN0737 AN0834 AN0903 AN0927 AN0932 AN0962 AN1015 AN1025 AN1028 AN1177 AN1207 AN1220 AN1252 AN1280 AN1288 AN1305 AN1309 AN1325 AN1440 AN1448 AN1452 AN1461 AN1464 AN1551 AN1557 AN1567 AN1589 AN1621 AN2030 AN2063	54
`Exchange Cmdlets`	DC0064 Command Execution	AN0740	1
`Execution of 'Get-WmiObject Win32_Product' or similar PowerShell cmdlets`	DC0064 Command Execution	AN1100	1
`Execution of Microsoft script to enumerate custom forms in Outlook mailbox`	DC0064 Command Execution	AN0085	1
`Execution of PowerShell script to enumerate or remove malicious Home Page folder config`	DC0064 Command Execution	AN0502	1
`Execution of PowerShell without -NoProfile flag`	DC0064 Command Execution	AN1245	1
`Get-ADTrust\|GetAllTrustRelationships`	DC0064 Command Execution	AN0016	1
`PowerShell launched from outlook.exe or triggered without user invocation`	DC0064 Command Execution	AN0263	1
`Scripts with references to XML parsing, AES decryption, or gpprefdecrypt logic`	DC0029 Script Execution	AN1075	1
`Set-ADUser or Set-ADAuthenticationPolicy with MFA attributes disabled`	DC0029 Script Execution	AN0543	1

Techniques detectable from this source

Technique	Tactics	Sigma rules	KEV CVEs
T1007 System Service Discovery	discovery	11	1
T1010 Application Window Discovery	discovery	1	0
T1012 Query Registry	discovery	14	0
T1016 System Network Configuration Discovery	discovery	12	1
T1016.001 Internet Connection Discovery	discovery	0	0
T1016.002 Wi-Fi Discovery	discovery	0	0
T1027.018 Invisible Unicode	stealth	0	0
T1033 System Owner/User Discovery	discovery	30	2
T1036.001 Invalid Code Signature	stealth	0	0
T1036.002 Right-to-Left Override	stealth	3	0
T1049 System Network Connections Discovery	discovery	9	1
T1056.002 GUI Input Capture	collection, credential access	3	0
T1059.001 PowerShell	execution	220	1
T1069 Permission Groups Discovery	discovery	3	1
T1069.002 Domain Groups	discovery	15	0
T1070.003 Clear Command History	stealth	9	0
T1070.004 File Deletion	stealth	15	5
T1070.005 Network Share Connection Removal	stealth	4	0
T1070.008 Clear Mailbox Data	stealth	2	0
T1074.002 Remote Data Staging	collection	0	0
T1082 System Information Discovery	discovery	33	7
T1087.002 Domain Account	discovery	21	5
T1087.003 Email Account	discovery	0	0
T1087.004 Cloud Account	discovery	3	0
T1114 Email Collection	collection	4	3
T1114.002 Remote Email Collection	collection	0	1
T1114.003 Email Forwarding Rule	collection	6	0
T1124 System Time Discovery	discovery	3	0
T1132.001 Standard Encoding	command and control	4	0
T1132.002 Non-Standard Encoding	command and control	0	0
T1135 Network Share Discovery	discovery	7	0
T1137.003 Outlook Forms	persistence	1	0
T1137.004 Outlook Home Page	persistence	0	0
T1137.005 Outlook Rules	persistence	0	0
T1197 BITS Jobs	stealth, persistence, execution	16	0
T1201 Password Policy Discovery	discovery	6	0
T1204.004 Malicious Copy and Paste	execution	6	0
T1205 Traffic Signaling	stealth, persistence, command and control	0	0
T1216 System Script Proxy Execution	stealth	13	0
T1216.001 PubPrn	stealth	2	0
T1216.002 SyncAppvPublishingServer	stealth	0	0
T1217 Browser Information Discovery	discovery	4	1
T1218.003 CMSTP	stealth	7	0
T1218.004 InstallUtil	stealth	0	0
T1218.009 Regsvcs/Regasm	stealth	4	0
T1218.013 Mavinject	stealth	2	0
T1218.014 MMC	stealth	2	0
T1222 File and Directory Permissions Modification	defense impairment	2	1
T1222.001 Windows Permissions	defense impairment	5	0
T1480 Execution Guardrails	stealth	0	0
T1480.001 Environmental Keying	stealth	0	0
T1482 Domain Trust Discovery	discovery	17	2
T1505.002 Transport Agent	persistence	3	0
T1518 Software Discovery	discovery	4	0
T1546.013 PowerShell Profile	privilege escalation, persistence	3	0
T1552.006 Group Policy Preferences	credential access	6	0
T1556.005 Reversible Encryption	defense impairment, persistence, credential access	0	0
T1556.006 Multi-Factor Authentication	defense impairment, persistence, credential access	3	0
T1564.008 Email Hiding Rules	stealth	4	0
T1564.011 Ignore Process Interrupts	stealth	0	0
T1615 Group Policy Discovery	discovery	5	0
T1674 Input Injection	execution	0	0
T1679 Selective Exclusion	stealth	0	0
T1690 Prevent Command History Logging	defense impairment	1	0

KEV CVEs reachable from this source

CVE	Vendor / product	Via technique	State
CVE-2012-0767	Adobe Flash Player	T1114.002	Mapped
CVE-2019-1653	Cisco Small Business RV320 and RV325 Routers	T1007 T1082	Mapped
CVE-2020-0688	Microsoft Exchange Server	T1114	Mapped
CVE-2020-1472	Microsoft Netlogon	T1087.002	Mapped
CVE-2020-3580	Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)	T1217	Mapped
CVE-2020-5902	F5 BIG-IP	T1070.004	Stale
CVE-2020-8195	Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance	T1082	Mapped
CVE-2020-8196	Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance	T1082	Mapped
CVE-2021-40449	Microsoft Windows	T1016 T1082	Mapped
CVE-2021-40539	Zoho ManageEngine	T1070.004 T1087.002	Mapped
CVE-2021-44077	Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus	T1070.004 T1087.002	Mapped
CVE-2021-44515	Zoho Desktop Central	T1069	Mapped
CVE-2022-22960	VMware Multiple Products	T1222	Mapped
CVE-2022-41082	Microsoft Exchange Server	T1059.001 T1482	Mapped
CVE-2022-41328	Fortinet FortiOS	T1049	Mapped
CVE-2023-22518	Atlassian Confluence Data Center and Server	T1033	Mapped
CVE-2023-22952	SugarCRM Multiple Products	T1070.004 T1482	Stale
CVE-2023-32315	Ignite Realtime Openfire	T1087.002	Mapped
CVE-2023-34362	Progress MOVEit Transfer	T1082	Mapped
CVE-2023-3519	Citrix NetScaler ADC and NetScaler Gateway	T1087.002	Mapped
CVE-2023-43770	Roundcube Webmail	T1082	Mapped
CVE-2024-23692	Rejetto HTTP File Server	T1082	Mapped
CVE-2024-27443	Synacor Zimbra Collaboration Suite (ZCS)	T1114	Mapped
CVE-2024-42009	Roundcube Webmail	T1114	Mapped
CVE-2024-4577	PHP Group PHP	T1033	Mapped
CVE-2025-32756	Fortinet Multiple Products	T1070.004	Mapped