4103 PowerShell log · Module Logging medium severity high volume

PowerShell Event ID 4103 — Module logging — pipeline execution details

Captures pipeline execution details including the full command pipeline (when Module Logging is enabled). Payload field contains the command text.

Why event 4103 matters

Captures most PowerShell commands when Module Logging is enabled. Reveals: encoded commands decoded (the decoded content appears), invocations of attack modules (PowerSploit, Empire, PowerView), credential theft, AMSI bypass attempts. Less complete than Script Block Logging (4104) but better than nothing.

How to detect it

Must ENABLE Module Logging: HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging. Alert: Payload contains Invoke-Mimikatz, Invoke-Shellcode, Invoke-ReflectivePEInjection, or other attack tool signatures. Alert: AMSI bypass attempts (amsiutils, amsicontext). Correlate with 4104 for full script content.

Log source
Microsoft-Windows-PowerShell/Operational
Enable PowerShell Module Logging and Script Block Logging via GPO (Administrative Templates → Windows PowerShell).
Fields to pivot on
PayloadContextInfoHostApplication

MITRE ATT&CK mapping

Tactic Technique
Execution PowerShell (T1059.001)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule
title: Malicious PowerShell Module Execution
status: experimental
description: PowerShell module logging captures known attack tool invocation
author: theadminstack.com
date: 2026/05/16
logsource:
    product: windows
    service: powershell
detection:
    selection:
        EventID: 4103
        Payload|contains:
            - 'Invoke-Mimikatz'
            - 'Invoke-Shellcode'
            - 'Invoke-ReflectivePEInjection'
            - 'PowerSploit'
            - 'Empire'
            - 'AmsiUtils'
    condition: selection
falsepositives:
    - Security testing in approved environments
level: critical
tags:
    - attack.execution
    - attack.t1059.001
    - attack.credential_access
Sentinel / Defender KQL
Event
| where EventLog == "Microsoft-Windows-PowerShell/Operational" and EventID == 4103   // Module logging — pipeline execution details
// EventData holds: Payload, ContextInfo, HostApplication
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Microsoft-Windows-PowerShell/Operational" EventCode=4103
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Module logging — pipeline execution details — add EventData fields: Payload, ContextInfo, HostApplication`
Hunt event 4103 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Frequently asked questions

What is PowerShell Event ID 4103?

Module logging — pipeline execution details. Captures pipeline execution details including the full command pipeline (when Module Logging is enabled). Payload field contains the command text.

Which log records event 4103?

Event 4103 is written to the Microsoft-Windows-PowerShell/Operational channel by Microsoft-Windows-PowerShell. Enable PowerShell Module Logging and Script Block Logging via GPO (Administrative Templates → Windows PowerShell).

What MITRE ATT&CK techniques map to event 4103?

Event 4103 is associated with: PowerShell (T1059.001).

How do you detect activity around event 4103?

Must ENABLE Module Logging: HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging. Alert: Payload contains Invoke-Mimikatz, Invoke-Shellcode, Invoke-ReflectivePEInjection, or other attack tool signatures. Alert: AMSI bypass attempts (amsiutils, amsicontext). Correlate with 4104 for full script content.