Added PowerShell Windows XML Event Log definition (#618)

ForensicArtifacts · Mar 8, 2024 · dcb57f8 · dcb57f8
1 parent b275745
commit dcb57f8
Showing 1 changed file with 14 additions and 0 deletions.
diff --git a/artifacts/data/windows.yaml b/artifacts/data/windows.yaml
@@ -3499,6 +3499,20 @@ sources:
 supported_os: [Windows]
 urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EventLog.html']
 ---
+name: WindowsXMLEventLogPowerShell
+doc: PowerShell Windows XML Event Logs.
+sources:
+- type: FILE
+  attributes:
+    paths:
+    - '%%environ_systemroot%%\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Admin.evtx'
+    - '%%environ_systemroot%%\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx'
+    - '%%environ_systemroot%%\System32\winevt\Logs\PowerShellCore Operational.evtx'
+    - '%%environ_systemroot%%\System32\winevt\Logs\Windows PowerShell.evtx'
+    separator: '\'
+supported_os: [Windows]
+urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EventLog.html']
+---
 name: WindowsXMLEventLogSecurity
 doc: Security Windows XML Event Log.
 sources: