Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. winevt
  5. Logs
  6. Windows PowerShell.evtx
LogRisk: Caution

Windows PowerShell.evtx C:\Windows\System32\winevt\Logs\Windows PowerShell.evtx

Classic "Windows PowerShell" log: engine and provider lifecycle and, if enabled, module logging. .evtx format.

Updated on By AltF4 Formation

What it’s for

Windows PowerShell.evtx is the classic “Windows PowerShell” log, specific to Windows PowerShell 5.1. It follows the life of the engine: start and stop, provider loading, and pipeline detail if that logging is on. It is not the script block log, which is Microsoft-Windows-PowerShell/Operational, nor the PowerShell 7 log, which writes to PowerShellCore/Operational. For how .evtx files work in general, see the winevt\Logs folder page.

What it contains

  • 400: engine start, with HostApplication and EngineVersion in the message. 403: engine stop.
  • 600: a provider starting (“Provider Registry is Started”, for example).
  • 800: pipeline execution details, when the matching logging is enabled through Group Policy.

Risks and best practices

  • Pipeline events can hold commands and their parameters, and so secrets typed in clear text. Restrict access to the log and protect exports.
  • This log alone will not catch an attack. Turn on script block logging (event 4104 in the Operational log) and module logging through Group Policy, then centralize the logs.
  • Look for 400 events whose EngineVersion is 2.0: that is the signature of a downgrade to the old engine, often used to dodge logging.
  • Do not try to delete the file: clear the log or export it with wevtutil, as administrator.

Useful commands

Fenêtre de terminal
# Engine starts with host version (ID 400)
Get-WinEvent -FilterHashtable @{LogName='Windows PowerShell'; Id=400} -MaxEvents 10 | Select-Object TimeCreated, Message


# Starts on the 2.0 engine (possible evasion attempt)
Get-WinEvent -FilterHashtable @{LogName='Windows PowerShell'; Id=400} |
    Where-Object Message -like '*EngineVersion=2.0*' | Select-Object TimeCreated, Message


# Log size and retention
wevtutil gl "Windows PowerShell"

Format

Binary XML file (.evtx) managed by the Windows Event Log service. Each event carries an ID, a level, a provider, a timestamp and a message. No text editor can read it.

Rotation and archiving

Maximum size and retention are set per log (Event Viewer, Group Policy or wevtutil sl). Archive by exporting: wevtutil epl "Windows PowerShell" C:\Temp\PowerShell.evtx.

How to read it

Event Viewer > Applications and Services Logs > Windows PowerShell. In PowerShell, use Get-WinEvent with -FilterHashtable to filter by ID (400, 403, 800). For a copied file: Get-WinEvent -Path ".\Windows PowerShell.evtx".

Report a mistake