CmdID

CmdID / PowerShell / Cmdlets / New

New-WinEvent

Creates a new Windows event for the specified event provider. PowerShell reference

From the PowerShell reference 4 parameters

Opens CmdID with your command, read as PowerShell. It is read in your browser and sent nowhere.

What it does

from the PowerShell reference, CC BY 4.0

Creates a new Windows event for the specified event provider. The New-WinEvent cmdlet creates an Event Tracing for Windows (ETW) event for an event provider. You can use this cmdlet to add events to ETW channels from PowerShell.

New-WinEvent [-ProviderName] <String> [-Id] <Int32> [-Version <Byte>] [[-Payload] <Object[]>] [<CommonParameters>]

Example 1 - Create a new event

New-WinEvent -ProviderName Microsoft-Windows-PowerShell -Id 45090 -Payload @("Workflow", "Running")Identify

Example 2 - Get the template for an event

(Get-WinEvent -ListProvider Microsoft-Windows-GroupPolicy).Events | Where-Object Id -EQ 8007Identify

Trips 1 Sigma rule: mediumEventLog Query Requests By Builtin Utilities by Ali Alwashali, Nasreddine Bencherchali (Nextron Systems)

Example 3 - Create a new event using a versioned template

$Payload = @(300, [uint32]'0x8001011f', $Env:USERNAME, 0, 1) New-WinEvent -ProviderName Microsoft-Windows-GroupPolicy -Id 8007 -Version 1 -Payload $Payload Get-WinEvent -ProviderName Microsoft-Windows-GroupPolicy -MaxEvents 1Identify

Trips 1 Sigma rule: mediumEventLog Query Requests By Builtin Utilities by Ali Alwashali, Nasreddine Bencherchali (Nextron Systems)

Its page in the reference: New-WinEvent.

Parameters

4 in the PowerShell reference
-IdSpecifies an event Id that is registered in the event provider.
-PayloadThe payload is an array of values passed as positional arguments to the event template. The values are inserted into the template to construct the message for the event. Events can have multiple template versions that use different formats. If the values in the payload do not match the types in the template, the event is logged but the payload contains an error.
-ProviderNameSpecifies the event provider that writes the event to an event log, such as "Microsoft-Windows-PowerShell". An ETW event provider is a logical entity that writes events to ETW sessions.
-VersionSpecifies the version number of the event. PowerShell converts the number to the required Byte type. The value specifies the version of the event when different versions of the same event are defined.

See also

Get-WinEvent