PowerShell Activity Detection Using Windows Security Logs

Detects and investigates suspicious PowerShell activity in Windows Security Logs by identifying PowerShell-related process creation and script execution events. The query displays the timestamp, user, process, parent process, and command-line details for further investigation.

index=windows (event_id=4688 OR event_id=4104)| 
search (process_name="*powershell*" OR cmd_line="*powershell*")|
table _time,user_name,process_name,parent_process,cmd_line|
sort _time