PowerShell logs and history

What it is

PowerShell is the attacker's favourite LOLBin: it downloads payloads, runs code in memory and drives lateral movement without dropping a binary. Windows keeps several independent traces of it. Two event logs record the engine and the code itself, the PSReadLine module saves what users typed at the console, and optional transcription writes whole sessions to text files. Each source has different defaults, so knowing what is logged out of the box is as important as knowing where to look.

Location

The history file name follows the host: ConsoleHost_history.txt for the console, Visual Studio Code Host_history.txt for the VS Code extension. Accounts such as SYSTEM keep theirs under C:\Windows\System32\config\systemprofile\AppData\Roaming\....

What it proves

• Code executed: event 4104 stores the text of each script block PowerShell compiled, including decoded -EncodedCommand content and code from Invoke-Expression, under the account that ran it.
• Engine start and command line: 400 (engine state None → Available) and 403 (Available → Stopped) in Windows PowerShell.evtx, with a HostApplication field holding the full launch command line.
• Commands and parameters: 4103 (module logging) in the Operational log and 800 (pipeline execution details) in the classic log record cmdlets and their bound parameters.
• What a user typed: ConsoleHost_history.txt lists interactive console commands, including those from sessions whose logs were cleared.
• It does not prove success: a logged block may have failed. PSReadLine does not capture scripts run with -File, non-interactive -Command launches or remoting sessions.

Key fields

Timestamps

Retention and clearing

• Nothing verbose is on by default. Script block, module and invocation logging must be enabled by policy (EnableScriptBlockLogging, EnableModuleLogging plus a ModuleNames list, EnableScriptBlockInvocationLogging). Without them, PowerShell still writes a warning-level 4104 for blocks containing content it considers suspicious.
• Event logs roll over when they reach their maximum size; on a busy host with script block logging, the Operational log can cover only days.
• PSReadLine keeps the last 4,096 commands by default (MaximumHistoryCount), saves after each command, and drops lines matching sensitive strings such as password, asplaintext, token, apikey or secret.
• Anti-forensics: Set-PSReadLineOption -HistorySaveStyle SaveNothing, deleting or editing the history file, wevtutil cl, running powershell -Version 2, or deleting the policy keys. Clearing a log leaves event 104 in System (1102 for Security); see Windows event logs.

Collection

• KAPE targets: EventLogs (all .evtx), PowerShellConsole (PSReadLine history and ISE autosave files), PowerShellTranscripts (default and common transcript folders).
• Velociraptor (Windows.Triage.Targets): EventLogs, PowerShellConsole, PowerShellTranscripts.
• Built-in: the policy keys live in the SOFTWARE hive (RegistryHivesSystem); export them or read them live.

wevtutil epl Microsoft-Windows-PowerShell/Operational E:\case\PS-Operational.evtx
wevtutil epl "Windows PowerShell" E:\case\WindowsPowerShell.evtx
Get-ChildItem C:\Users\*\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\*_history.txt -Force |
  Copy-Item -Destination E:\case\PSReadLine\ -PassThru
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell /s

A transcript in a custom OutputDirectory is not covered by the default targets: read the Transcription policy key first and collect that folder separately.

Parsing tools

• EvtxECmd (Eric Zimmerman): ships maps for 4103, 4104, 400, 403, 600 and 800, plus 4104 in PowerShellCore/Operational.
• Chainsaw and Hayabusa (open source): Sigma-based hunting over 4104 and the classic log.
• Velociraptor: Windows.EventLogs.PowershellScriptblock (4104, defaults to warning-level blocks), Windows.EventLogs.PowershellModule (4103) and Windows.System.Powershell.PSReadline.
• Get-WinEvent: filter by ID and join ScriptBlockText segments by ScriptBlockId to rebuild long scripts.
• Any text editor for ConsoleHost_history.txt and transcripts.

Investigation tips

• Start with warning-level 4104 events: they exist even where nobody enabled logging, and they flag exactly the blocks PowerShell itself found suspicious.
• Rebuild split scripts by ScriptBlockId before decoding; the payload is often a Base64 or compressed blob in a later segment.
• Compare HostApplication in 400 with 4104: powershell.exe -nop -w hidden -enc ... launched by wmiprvse.exe, mshta.exe or an Office process points to WMI or macro execution.
• Check every user's ConsoleHost_history.txt, including service and admin accounts: attackers on an interactive session often type Invoke-WebRequest, Add-MpPreference -ExclusionPath or credential-dumping commands.
• Correlate powershell.exe runs in Prefetch with 4104 time ranges, and look for AMSI detections in Microsoft Defender logs for the same scripts.
• Review the logging policy keys and their last write time: logging switched off shortly before the incident is itself anti-forensics.