Event ID 4103: Executing pipeline (module logging)
Records PowerShell commands and their parameters as they run in the pipeline.
- Log
- Microsoft-Windows-PowerShell/Operational
- Category
- Execution
Why it matters
- Complements 4104 by showing the values passed to each command at run time.
What to check
Check CommandInvocation and ParameterBinding lines for the commands that ran and their inputs.
How to turn it on
Group Policy: Administrative Templates > Windows Components > Windows PowerShell > Turn on Module Logging (module names: *).
MITRE ATT&CK
- T1059.001 PowerShell