[PowerShell 4104 ](https://github.com/Cyb3rWard0g/OSSEM/blob/master/data_dictionaries/windows/powershell/events/event-4104.md) needs to match [HELK](https://github.com/Cyb3rWard0g/HELK/blob/master/docker/helk-logstash/pipeline/2511-winevent-powershell-filter.conf). Few fields that we parse from here that are not in here. Also I believe [powershell_Path](https://github.com/Cyb3rWard0g/OSSEM/blame/master/data_dictionaries/windows/powershell/events/event-4104.md#L57) should be powershell_path @Cyb3rWard0g probably going to need your input on this, since the original parser you had some modifications - so just wanted to get your final on it.