Script Content | PowerShell Execution with Full Script Body

chiki briki@ekkor13

•updated Aug 9, 2026•19•0•15

Extracts full PowerShell script content from DOT_NET telemetry (dynamic_event_string_map key 25), grouped by process causality ID so each row = one script execution with its complete body. Filter by hostname or username via parameter. Use for investigating script-based alerts, hunting suspicious PowerShell, or validating FP exclusions