Event ID 4103InformationMicrosoft-Windows-PowerShell/OperationalT1059.001

Windows Event ID 4103 — PowerShell Module Logging

Logged for each PowerShell pipeline execution, capturing the module and function called. Less detailed than Script Block Logging (4104) but lower overhead.

MITRE ATT&CK

Technique

T1059.001 · PowerShell

Tactic

Execution

View on attack.mitre.org →

Why It Matters

Module logging captures command invocations even when scripts are obfuscated or downloaded in-memory. Attackers using PowerShell for C2, lateral movement, or credential access will generate 4103 events.

Key Fields

PayloadThe command or module executed
UserThe account running PowerShell
Host Name / Host ApplicationWhere PowerShell is running — ConsoleHost is interactive; unexpected hosts may indicate process injection

Investigation Tips

  1. 1.Look for Invoke-Mimikatz, Invoke-ReflectivePEInjection, or other known offensive module names.
  2. 2.PowerShell running as SYSTEM in a non-interactive context is suspicious.
  3. 3.Correlate with 4688 to see what launched PowerShell.

Go deeper: the full PowerShell Abuse — Living Off the Land guide

Explore the related technique, investigation steps, and evidence to consider alongside this event.

Read the PowerShell Abuse — Living Off the Land guide →

See Event ID 4103 in your logs

Copy the event details as XML and inspect them in your browser. No file upload or hosted analysis is needed.

Decode an event →
← All detection guides·Decode an event →