Skip to content

PowerShell Module Logging

Named by 2 kept items in this workspace.

1 items name it under techniques and 1 under tools.

Search every workspace for PowerShell Module Logging. It matches the name as written, so it can find other things that share it.

The items that name it 2

  • Field Notes: Reconstructing an Attacker’s Workflow
    writeupas tools2026-10-22It is written here as PowerShell Module Logging (Event ID 4103): adds visibility into PowerShell activity.

    Event ID 4103

  • ScriptBlock Smuggling
    writeupas techniques2024-09-13It is written here as PowerShell Module Logging (Event ID 4103).

    Defensive logging capturing detailed executed PowerShell code/module activity; still captured evidence of the actual malicious code even when ScriptBlock Smuggling was used to evade Script Block Logging.

All techniques in this workspace.