hunters-forge-OSSEM/detection_data_model/data_objects/powershell.md

Standard Name	Field Name	Type	Description	Sample Value
powershell_new_engine_state	NewEngineState	string		Available
powershell_previous_engine_state	PreviousEngineState	string		None
powershell_sequence_number	SequenceNumber	integer		13
powershell_host_name	HostName	string		ConsoleHost
powershell_host_version	HostVersion	string		5.1.16299.251
powershell_host_id	HostId	string		f90b931a-dc4d-488a-b1b8-e0b7dbcdc0c7
powershell_host_application	HostApplication	string		powershell.exe
powershell_engine_version	EngineVersion	string		5.1.16299.251
powershell_runspace_id	RunspaceId	string		0dfc1f10-3bce-4885-8dbf-58ed28eba179
powershell_pipeline_id	PipelineId	integer
powershell_command_name	CommandName	string
powershell_command_type	CommandType	string
powershell_script_name	ScriptName	string
powershell_command_path	CommandPath	string
powershell_command_line	CommandLine	string
powershell_command_invocation	CommandInvocation	string		Get-ChildItem
powershell_parameter_binding	ParameterBinding	string		Filter
powershell_severity	Severity	string		Informational
powershell_sequence_number	Sequence Number	string		88
user_name	User	string		wardog
user_domain	User	string		DESKTOP-WARDOG
powershell_connected_user	Connected User	string
powershell_shell_id	Shell ID	string		Microsoft.PowerShell
powershell_message_number	MessageNumber	integer		1
powershell_parameter_binding	MessageTotal	integer		1
powershell_scriptblock_text	ScriptBlockText	string		function Invoke-ATTACKAPI..
powershell_scriptblock_id	ScriptBlockId	string		1c97482f-51a2-4cf9-8abd-df9769b6e373
powershell_Path	Path	string		C:\Tools\Invoke-ATTACKAPI-master\Invoke-ATTACKAPI.ps1
event_provider_name	ProviderName	string		Variable
powershell_new_provider_state	NewProviderState	string		Started