Windows host logs

Quick pivots for native Windows event logs and PowerShell.

List available event logs

Get-WinEvent -ListLog * | Where-Object IsEnabled

Recent process creation events

Security Event ID 4688 records process creation when process auditing is enabled.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddHours(-1)}

Recent PowerShell script blocks

PowerShell Operational Event ID 4104 records script block content when Script Block Logging is enabled.

Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; Id=4104; StartTime=(Get-Date).AddHours(-1)}

Failed logons

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddHours(-1)}

Export one event log

wevtutil epl Security C:\Temp\Security.evtx