PowerShell session ended. Complements 400 for session duration.
Use with Event 400 to calculate session duration. Long-running hidden sessions warrant investigation.
No standalone alerting. Use with Event 400 for session timeline.
ScriptBlockTextPathHostApplication Starting points — adapt the log source, projected fields and thresholds for your environment.
Event
| where EventLog == "Microsoft-Windows-PowerShell/Operational" and EventID == 403 // PowerShell engine stopped
// EventData holds: ScriptBlockText, Path, HostApplication
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Microsoft-Windows-PowerShell/Operational" EventCode=403
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# PowerShell engine stopped — add EventData fields: ScriptBlockText, Path, HostApplication`PowerShell engine stopped. PowerShell session ended. Complements 400 for session duration.
Event 403 is written to the Microsoft-Windows-PowerShell/Operational channel by Microsoft-Windows-PowerShell. Enable PowerShell Module Logging and Script Block Logging via GPO (Administrative Templates → Windows PowerShell).
No standalone alerting. Use with Event 400 for session timeline.