{
    "Event": {
        "xmlns": "http://schemas.microsoft.com/win/2004/08/events/event",
        "System": {
            "Provider": {
                "Name": "Microsoft-Windows-PowerShell",
                "Guid": "{A0C1853B-5C40-4B15-8766-3CF1C58F985A}"
            },
            "EventID": "4103",
            "Version": "1",
            "Level": "4",
            "Task": "106",
            "Opcode": "20",
            "Keywords": "0x0",
            "TimeCreated": {
                "SystemTime": "2020-01-09T10:27:07.462331500Z"
            },
            "EventRecordID": "5969",
            "Correlation": {
                "ActivityID": "{67FFECC3-C6A6-0003-4625-0068A6C6D501}"
            },
            "Execution": {
                "ProcessID": "900",
                "ThreadID": "5716"
            },
            "Channel": "Microsoft-Windows-PowerShell/Operational",
            "Computer": "server16.server16.int",
            "Security": {
                "UserID": "S-1-5-21-3500636268-2529342812-1271244175-500"
            }
        },
        "EventData": {
            "Data": [
                {
                    "text": " Severity = Informational\r\n Host Name = ConsoleHost\r\n Host Version = 5.1.14393.0\r\n Host ID = eff1cb0e-f049-4c74-ba71-3c6d3600bdb4\r\n Host Application = C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -Command if((Get-ExecutionPolicy ) -ne 'AllSigned') { Set-ExecutionPolicy -Scope Process Bypass }; & 'C:\\mrunner\\sc\\1.ps1'\r\n Engine Version = 5.1.14393.0\r\n Runspace ID = ef6d37e8-7288-4c8b-b7be-a1474dc7d1d7\r\n Pipeline ID = 1\r\n Command Name = Set-ExecutionPolicy\r\n Command Type = Cmdlet\r\n Script Name = \r\n Command Path = \r\n Sequence Number = 21\r\n User = SERVER160\\Administrator\r\n Connected User = \r\n Shell ID = Microsoft.PowerShell\r\n",
                    "Name": "ContextInfo"
                },
                {
                    "Name": "UserData"
                },
                {
                    "text": "CommandInvocation(Set-ExecutionPolicy): \"Set-ExecutionPolicy\"\r\nParameterBinding(Set-ExecutionPolicy): name=\"Scope\"; value=\"Process\"\r\nParameterBinding(Set-ExecutionPolicy): name=\"ExecutionPolicy\"; value=\"Bypass\"\r\nTerminatingError(Set-ExecutionPolicy): \"Windows PowerShell updated your execution policy successfully, but the setting is overridden by a policy defined at a more specific scope. Due to the override, your shell will retain its current effective execution policy of Unrestricted. Type \"Get-ExecutionPolicy -List\" to view your execution policy settings. For more information please see \"Get-Help Set-ExecutionPolicy\".\"\r\n",
                    "Name": "Payload"
                }
            ]
        }
    }
}