From bbd082dfaf6f790ad5eb71d4b7936eaa71f9d014 Mon Sep 17 00:00:00 2001
From: bfuzzy <36494941+bfuzzy@users.noreply.github.com>
Date: Tue, 22 May 2018 11:21:07 -0400
Subject: [PATCH] added powershell w/o descriptions

---
 .../data_objects/powershell.md                | 32 +++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100644 detection_data_model/data_objects/powershell.md

diff --git a/detection_data_model/data_objects/powershell.md b/detection_data_model/data_objects/powershell.md
new file mode 100644
index 000000000..c31242a2b
--- /dev/null
+++ b/detection_data_model/data_objects/powershell.md
@@ -0,0 +1,32 @@
+| Standard Name | Field Name | Type | Description | Sample Value |
+| ---------------- | ---------------- | ---------------- | ---------------- | ---------------- |
+| powershell\_new_engine\_state | NewEngineState | string |  | Available |
+| powershell\_previous\_engine\_state | PreviousEngineState | string |  | None |
+| powershell\_sequence\_number | SequenceNumber | integer | | 13 |
+| powershell\_host\_name | HostName | string | | ConsoleHost |
+| powershell\_host\_version | HostVersion | string | | 5.1.16299.251 |
+| powershell\_host\_id | HostId | string | | f90b931a-dc4d-488a-b1b8-e0b7dbcdc0c7 |
+| powershell\_host\_application | HostApplication | string | | powershell.exe |
+| powershell\_engine\_version | EngineVersion | string | | 5.1.16299.251 |
+| powershell\_runspace\_id | RunspaceId | string | | 0dfc1f10-3bce-4885-8dbf-58ed28eba179 |
+| powershell\_pipeline\_id | PipelineId | integer | | |
+| powershell\_command\_name | CommandName | string | | |
+| powershell\_command\_type | CommandType | string | | |
+| powershell\_script\_name | ScriptName | string | | |
+| powershell\_command\_path | CommandPath | string | | |
+| powershell\_command\_line | CommandLine | string | | |
+| powershell\_command\_invocation | CommandInvocation | string | | Get-ChildItem |
+| powershell\_parameter\_binding | ParameterBinding | string | | Filter |
+| powershell\_severity | Severity | string | | Informational |
+| powershell\_sequence\_number | Sequence Number | string | | 88 |
+| user\_name | User | string | | wardog |
+| user\_domain | User | string | | DESKTOP-WARDOG |
+| powershell\_connected\_user | Connected User | string | | |
+| powershell\_shell\_id | Shell ID | string | | Microsoft.PowerShell |
+| powershell\_message\_number | MessageNumber | integer | | 1 |
+| powershell\_parameter\_binding | MessageTotal | integer | | 1 |
+| powershell\_scriptblock\_text | ScriptBlockText | string |  | function Invoke-ATTACKAPI.. |
+| powershell\_scriptblock\_id | ScriptBlockId | string | | 1c97482f-51a2-4cf9-8abd-df9769b6e373 |
+| powershell\_Path | Path | string |  | C:\Tools\Invoke-ATTACKAPI-master\Invoke-ATTACKAPI.ps1 |
+| event\_provider\_name | ProviderName | string | | Variable |
+| powershell\_new\_provider\_state | NewProviderState | string | | Started |