Get-WinEvent

Gets events from event logs and event tracing log files on local and remote computers. PowerShell reference

From the PowerShell reference 13 parameters 2 Sigma rules look for it

What it does

from the PowerShell reference, CC BY 4.0

Gets events from event logs and event tracing log files on local and remote computers. The Get-WinEvent cmdlet gets events from event logs, including classic logs, such as the System and Application logs. The cmdlet gets data from event logs that are generated by the Windows Event Log technology introduced in Windows Vista and events in log files generated by Event Tracing for Windows (ETW). By default, Get-WinEvent returns event information in the order of newest to oldest. Get-WinEvent lists event logs and event log providers. To interrupt the command, press <kbd>CTRL</kbd>+<kbd>C</kbd>. You can get events from selected logs or from logs generated by selected event providers. And, you can combine events from multiple sources in a single command. Get-WinEvent allows you to filter events using XPath queries, structured XML queries, and hash table queries. If you're not running PowerShell as an Administrator, you might see error messages that you can't retrieve information about a log.

Get-WinEvent [[-LogName] <String[]>] [-MaxEvents <Int64>] [-ComputerName <String>] [-Credential <PSCredential>] [-FilterXPath <String>] [-Force] [-Oldest] [<CommonParameters>]

Get-WinEvent [-ListLog] <String[]> [-ComputerName <String>] [-Credential <PSCredential>] [-Force] [<CommonParameters>]

Get-WinEvent [-ListProvider] <String[]> [-ComputerName <String>] [-Credential <PSCredential>] [<CommonParameters>]

Get-WinEvent [-ProviderName] <String[]> [-MaxEvents <Int64>] [-ComputerName <String>] [-Credential <PSCredential>] [-FilterXPath <String>] [-Force] [-Oldest] [<CommonParameters>]

Get-WinEvent [-Path] <String[]> [-MaxEvents <Int64>] [-Credential <PSCredential>] [-FilterXPath <String>] [-Oldest] [<CommonParameters>]

Get-WinEvent [-MaxEvents <Int64>] [-ComputerName <String>] [-Credential <PSCredential>] [-FilterHashtable] <Hashtable[]> [-Force] [-Oldest] [<CommonParameters>]

Get-WinEvent [-MaxEvents <Int64>] [-ComputerName <String>] [-Credential <PSCredential>] [-FilterXml] <XmlDocument> [-Oldest] [<CommonParameters>]

Get all the logs from a local computer

Get-WinEvent -ListLog *Identify

Trips 1 Sigma rule: mediumEventLog Query Requests By Builtin Utilities by Ali Alwashali, Nasreddine Bencherchali (Nextron Systems)

Get the classic Setup log

Get-WinEvent -ListLog Setup | Format-List -Property *Identify

Trips 1 Sigma rule: mediumEventLog Query Requests By Builtin Utilities by Ali Alwashali, Nasreddine Bencherchali (Nextron Systems)

Configure the classic Security log

$log = Get-WinEvent -ListLog Security
$log.MaximumSizeInBytes = 1gb
try{
$log.SaveChanges()
Get-WinEvent -ListLog Security | Format-List -Property *
}catch [System.UnauthorizedAccessException]{
$ErrMsg = 'You don't have permission to configure this log!'
$ErrMsg += ' Try running this script with administrator privileges. '
$ErrMsg += $_.Exception.Message
Write-Error $ErrMsg
}

Identify

Trips 2 Sigma rules: mediumEventLog Query Requests By Builtin Utilities by Ali Alwashali, Nasreddine Bencherchali (Nextron Systems); mediumPotentially Suspicious EventLog Recon Activity Using Log Query Utilities by Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)

Get event logs from a server

Get-WinEvent -ListLog * -ComputerName localhost | Where-Object { $_.RecordCount }Identify

Trips 1 Sigma rule: mediumEventLog Query Requests By Builtin Utilities by Ali Alwashali, Nasreddine Bencherchali (Nextron Systems)

Get event logs from multiple servers

$S = 'Server01', 'Server02', 'Server03'
foreach ($Server in $S) {
Get-WinEvent -ListLog Application -ComputerName $Server |
Select-Object LogMode, MaximumSizeInBytes, RecordCount, LogName,
@{Name='ComputerName'; Expression={$Server}} |
Format-Table -AutoSize
}

Identify

Trips 1 Sigma rule: mediumEventLog Query Requests By Builtin Utilities by Ali Alwashali, Nasreddine Bencherchali (Nextron Systems)

Get event log providers and log names

Get-WinEvent -ListProvider *Identify

Trips 1 Sigma rule: mediumEventLog Query Requests By Builtin Utilities by Ali Alwashali, Nasreddine Bencherchali (Nextron Systems)

Get all event log providers that write to a specific log

(Get-WinEvent -ListLog Application).ProviderNamesIdentify

Trips 1 Sigma rule: mediumEventLog Query Requests By Builtin Utilities by Ali Alwashali, Nasreddine Bencherchali (Nextron Systems)

Get event log provider names that contain a specific string

Get-WinEvent -ListProvider PolicyIdentify

Trips 1 Sigma rule: mediumEventLog Query Requests By Builtin Utilities by Ali Alwashali, Nasreddine Bencherchali (Nextron Systems)

Get Event Ids that the event provider generates

(Get-WinEvent -ListProvider Microsoft-Windows-GroupPolicy).Events |
Format-Table Id, Description

Identify

Trips 1 Sigma rule: mediumEventLog Query Requests By Builtin Utilities by Ali Alwashali, Nasreddine Bencherchali (Nextron Systems)

Get log information from event object properties

$Event = Get-WinEvent -LogName 'Windows PowerShell'
$Event.Count
$Event | Group-Object -Property Id -NoElement |
Sort-Object -Property Count -Descending
$Event | Group-Object -Property LevelDisplayName -NoElement

Identify

Its page in the reference: Get-WinEvent.

Parameters

13 in the PowerShell reference

-ComputerNameSpecifies the name of the computer that this cmdlet gets events from the event logs. Type the NetBIOS name, an IP address, or the fully qualified domain name (FQDN) of the computer. The default value is the local computer, localhost. This parameter accepts only one computer name at a time. To get event logs from remote computers, configure the firewall port for the event log service to allow remote access. This cmdlet doesn't rely on PowerShell remoting. You can use the ComputerName parameter even if your computer isn't configured to run remote commands.

-CredentialSpecifies a user account that has permission to perform this action. The default value is the current user.

-FilterHashtableSpecifies a query in hash table format to select events from one or more event logs. The query contains a hash table with one or more key/value pairs. Hash table queries have the following rules: - Keys and values are case-insensitive. - Wildcard characters are valid only in the values associated with the LogName and ProviderName keys. - Each key can be listed only once in each hash table. - The Path value takes paths to .etl, .evt, and .evtx log files. - The LogName, Path, and ProviderName keys can be used in the same query. - The UserID key can take a valid security identifier (SID) or a domain account name that can be used to construct a valid System.Security.Principal.NTAccount object. - The Data value takes event data in an unnamed field. For example, events in classic event logs. When Get-WinEvent can't interpret a key/value pair, it interprets the key as a case-sensitive name for the event data in the event. The valid Get-WinEvent key/value pairs are as follows: - LogName=<String[]> - ProviderName=<String[]> - Path=<String[]> - Keywords=<Long[]> - ID=<Int32[]> - Level=<Int32[]> - StartTime=<DateTime> - EndTime=<DateTime> - UserID=<SID> - Data=<String[]>

-FilterXmlSpecifies a structured XML query that this cmdlet selects events from one or more event logs. To generate a valid XML query, use the Create Custom View and Filter Current Log features in Windows Event Viewer. Use the items in the dialog box to create a query, and then click the XML tab to view the query in XML format. You can copy the XML from the XML tab into the value of the FilterXml parameter. For more information about the Event Viewer features, see Event Viewer Help. Use an XML query to create a complex query that contains several XPath statements. The XML format also allows you to use a Suppress XML element that excludes events from the query. For more information about the XML schema for event log queries, see Query Schema and the XML Event Queries section of Event Selection.

-FilterXPathSpecifies an XPath query that this cmdlet select events from one or more logs. For more information about the XPath language, see XPath Reference and the _Selection Filters_ section of Event Selection.

-ForceGets debug and analytic logs, in addition to other event logs. The Force parameter is required to get a debug or analytic log when the value of the Name parameter includes wildcard characters. By default, the Get-WinEvent cmdlet excludes these logs unless you specify the full name of a debug or analytic log.

-ListLogSpecifies the event logs. Enter the event log names in a comma-separated list. Wildcards are permitted. To get all the logs, use the asterisk (*) wildcard.

-ListProviderSpecifies the event log providers that this cmdlet gets. An event log provider is a program or service that writes events to the event log. Enter the provider names in a comma-separated list. Wildcards are permitted. To get the providers of all the event logs on the computer, use the asterisk (*) wildcard.

-LogNameSpecifies the event logs that this cmdlet get events from. Enter the event log names in a comma-separated list. Wildcards are permitted. You can also pipe log names to the Get-WinEvent cmdlet. NOTE: PowerShell doesn't limit the amount of logs you can request. However, the Get-WinEvent cmdlet queries the Windows API which has a limit of 256. This can make it difficult to filter through all of your logs at one time. You can work around this by using a foreach loop to iterate through each log like this: Get-WinEvent -ListLog * | ForEach-Object{ Get-WinEvent -LogName $_.LogName }

-MaxEventsSpecifies the maximum number of events that are returned. Enter an integer such as 100. The default is to return all the events in the logs or files.

-OldestIndicate that this cmdlet gets the events in oldest-first order. By default, events are returned in newest-first order. This parameter is required to get events from .etl and .evt files and from debug and analytic logs. In these files, events are recorded in oldest-first order, and the events can be returned only in oldest-first order.

-PathSpecifies the path to the event log files that this cmdlet get events from. Enter the paths to the log files in a comma-separated list, or use wildcard characters to create file path patterns. Get-WinEvent supports files with the .evt, .evtx, and .etl file name extensions. You can include events from different files and file types in the same command.

-ProviderNameSpecifies, as a string array, the event log providers from which this cmdlet gets events. Enter the provider names in a comma-separated list, or use wildcard characters to create provider name patterns. An event log provider is a program or service that writes events to the event log. It isn't a PowerShell provider.

What looks for it

Sigma process creation rules that name Get-WinEvent

mediumEventLog Query Requests By Builtin UtilitiesAli Alwashali, Nasreddine Bencherchali (Nextron Systems)

mediumPotentially Suspicious EventLog Recon Activity Using Log Query UtilitiesNasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)

Get-WinEvent

What it does

Parameters

What looks for it

See also