Get-WinEvent

Get-WinEvent is the primary PowerShell cmdlet for querying Windows event logs. It replaces the legacy Get-EventLog cmdlet and supports both live logs and archived .evtx files.

Basic usage

# Get help
Get-Help Get-WinEvent
 
# List all logs available on the system
Get-WinEvent -ListLog *
 
# List providers (sources) for a specific log
Get-WinEvent -ListProvider * -LogName Application

Filtering

Two approaches — -FilterHashtable is strongly preferred:

Where-Object (post-filtering — slow for large logs)

Pipes all events through Where-Object after retrieval. Works on any source including archived logs (-Path).

Get-WinEvent -LogName Application | Where-Object {
    $_.ProviderName -Match 'WLMS'
}
 
# Match by event ID (note the different syntax)
Get-WinEvent -LogName Application | Where-Object Id -eq 100

-FilterHashtable (filter at the source — fast)

Filtering is done during the query itself. More efficient and cleaner syntax, but only works against live logs — use Where-Object for archived logs via -Path.

Get-WinEvent -FilterHashtable @{
    LogName      = 'Application'
    ProviderName = 'WLMS'
}
 
# Filter by event ID and time range
Get-WinEvent -FilterHashtable @{
    LogName   = 'Security'
    Id        = 4625
    StartTime = (Get-Date).AddDays(-1)
    EndTime   = Get-Date
}

FilterHashtable keys

Key	Type	Notes
LogName	String	Wildcards supported
ProviderName	String	Wildcards supported
Path	String	Path to .evtx file
Keywords	Long	See keyword values below
ID	Int32	Event ID
Level	Int32	See level values below
StartTime	DateTime
EndTime	DateTime
UserID	SID
Data	String	Event data string

Hash keys can be written with newlines instead of semicolons for readability.

Keyword values

Keyword	Value
AuditFailure	4503599627370496
AuditSuccess	9007199254740992
CorrelationHint2	18014398509481984
EventLogClassic	36028797018963968
Sqm	2251799813685248
WdiDiagnostic	1125899906842624
WdiContext	562949953421312
ResponseTime	281474976710656
None	0

Level values

Level	Value
Verbose	5
Informational	4
Warning	3
Error	2
Critical	1
LogAlways	0

Displaying full event details

# Show all properties of an event
Get-WinEvent -LogName Application -MaxEvents 1 | Format-List -Property *

Security use cases

• Hunt for AMSI bypass attempts via PowerShell script block logging (event 4104 in Microsoft-Windows-PowerShell/Operational)
• Detect log clearing (events 104/1102) — see windows-event-logs > notable-event-ids
• Correlate 4624/4625 logon events to identify brute-force or lateral movement
• Review 4688 process creation events for suspicious command lines

Sources

• Get-WinEvent — Microsoft Learn
• Creating Get-WinEvent Queries with FilterHashtable — Microsoft Learn

Related: windows-event-logs, amsi-bypass, windows-reconnaissance-commands