PowerShell Event ID 4100 — PowerShell script execution error — SecOps Tools

Why event 4100 matters

Attack tools generating errors during execution — useful for detecting failed attack attempts. Encoded commands that fail to decode properly. Also useful for detecting when defenses blocked execution.

How to detect it

Alert: errors from suspicious scripts or encoded commands. Look for access denied errors on sensitive paths from unexpected processes.

Log source

Microsoft-Windows-PowerShell/Operational

Enable PowerShell Module Logging and Script Block Logging via GPO (Administrative Templates → Windows PowerShell).

Fields to pivot on

ScriptBlockTextPathHostApplication

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL

Event
| where EventLog == "Microsoft-Windows-PowerShell/Operational" and EventID == 4100   // PowerShell script execution error
// EventData holds: ScriptBlockText, Path, HostApplication
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc

Splunk SPL

index=* sourcetype="WinEventLog:Microsoft-Windows-PowerShell/Operational" EventCode=4100
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# PowerShell script execution error — add EventData fields: ScriptBlockText, Path, HostApplication`

Hunt event 4100 in Sentinel/Defender →

Build a KQL query for this event in the KQL Query Builder.

Search all event IDs →

Open the interactive Windows Event ID lookup.

Frequently asked questions

What is PowerShell Event ID 4100?

PowerShell script execution error. An error occurred during PowerShell script execution. ErrorRecord and ScriptName are key.

Which log records event 4100?

Event 4100 is written to the Microsoft-Windows-PowerShell/Operational channel by Microsoft-Windows-PowerShell. Enable PowerShell Module Logging and Script Block Logging via GPO (Administrative Templates → Windows PowerShell).

How do you detect activity around event 4100?

Alert: errors from suspicious scripts or encoded commands. Look for access denied errors on sensitive paths from unexpected processes.