We are looking to add all powershell command line events to the Windows Event Logs. I.E a bad guy tries to run powershell empire etc. We found and article that talks about adding this –
Add the below lines to %windir%\system32\WindowsPowerShell\v1.0\profile.ps1; this is for all users of the computer and for all shells.
$LogCommandHealthEvent = $true
$LogCommandLifeCycleEvent = $true