Windows Event ID 4103: PowerShell Module Logging
- Applicable version
- Windows PowerShell 3.0 and later with Module Logging enabled
- Last reviewed
- 2026-07-21
Quick summary
PowerShell Event ID 4103 records pipeline execution details for configured modules and provides command-level context for PowerShell activity.
Technical Metadata
| Event ID | 4103 |
|---|---|
| Provider | Microsoft-Windows-PowerShell |
| Channel | Microsoft-Windows-PowerShell/Operational |
| Level | Information |
| MITRE ATT&CK | TA0002 Execution / T1059.001 Command and Scripting Interpreter: PowerShell |
| Key fields to watch | Payload, HostApplication, UserId |
Trigger Scenarios
The PowerShell operational log writes this event when Module Logging is enabled and a configured module processes commands.
Key Fields
Payload
The logged command and parameter data. Review it with the associated host and user context.
HostApplication
The PowerShell host command line, which can expose encoded commands and noninteractive execution.
UserId
The security principal running the pipeline.
Threat Hunting Queries
WindowsEvent
| where EventID == 4103
| project TimeGenerated, Computer, EventData
| order by TimeGenerated desc- Data source
- Microsoft Sentinel WindowsEvent table
- Assumptions
- PowerShell Operational events are collected into WindowsEvent and EventData retains the provider payload. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
index=wineventlog source="XmlWinEventLog:Microsoft-Windows-PowerShell/Operational" EventCode=4103
| table _time, host, user, EventCode, Message- Data source
- Splunk PowerShell Operational event data
- Assumptions
- Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before implementing event-specific filtering or aggregation.
dataset = microsoft_windows_raw
| filter edr_event_id = 4103- Data source
- Cortex XDR microsoft_windows_raw
- Assumptions
- The relevant Windows event channel is ingested through a Cortex XDR Windows event collection path. Inspect raw provider fields because parsed field names vary by collection path and event provider.
title: Windows Event ID 4103
status: experimental
logsource:
product: windows
service: powershell-classic
detection:
selection:
EventID: 4103
condition: selection
falsepositives:
- Legitimate administrative or system activity
level: informational- Data source
- Sigma PowerShell event log source
- Assumptions
- This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Documented Values and Codes
| Field | Value | Meaning | Security relevance |
|---|---|---|---|
| Event ID | 4103 | PowerShell module logging records pipeline execution details for selected modules. | The payload can expose commands and parameters that are not visible in process-creation command lines. Source |
| Policy path | HKLM\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging | The Group Policy-backed registry area controls PowerShell module logging. | Absence of 4103 data can be a configuration gap; verify policy scope before treating missing events as attacker suppression. Source |
MITRE ATT&CK Mapping
- T1059.001Command and Scripting Interpreter: PowerShell
Detection Notes
T1059.001 is actionable when HostApplication contains -EncodedCommand and Payload contains FromBase64String or Invoke-Expression. The -EncodedCommand switch carries Base64 command text, so join its UserId and host with 4104 ScriptBlockText and 4688; PowerShell running from C:\\Windows\\System32 is not benign by path alone.
Common False Positives
- Administrative automation and configuration management often generate extensive module logging.
- Developer and operations systems can have diverse PowerShell command activity.
Related Events
Sample Log
EventCode: 4103
UserId: CORP\jsmith
HostApplication: powershell.exe -NoProfile
Payload: CommandInvocation(Invoke-WebRequest): "Invoke-WebRequest"Frequently Asked Questions
What does PowerShell Event ID 4103 record?
Event ID 4103 is produced by PowerShell module logging and records pipeline execution details for modules selected by policy.
How is Event ID 4103 different from 4104?
Event ID 4103 focuses on module and pipeline execution details, while 4104 script block logging records processed PowerShell script blocks.
Does Event ID 4103 prove malicious PowerShell use?
No. Administrative automation also generates 4103; analysts must evaluate the payload, host application, user, encoded content, and related process activity.
Sources
- about_Logging_Windows
Microsoft · vendor
- Command and Scripting Interpreter: PowerShell (T1059.001)
MITRE ATT&CK · attack
- XDR Collector datasets
Palo Alto Networks · vendor
- Sigma Rules Specification
SigmaHQ · detection rule