Skip to content
PowerShellparser

Glossary

Windows PowerShell classic log

The original Windows PowerShell.evtx log holding engine and provider lifecycle (400/403/600) and pipeline execution (800) events.

The Windows PowerShell log (Windows PowerShell.evtx in System32\winevt\Logs) is PowerShell's original event log. It predates the modern per-provider channels, which is why PowerShell later added Microsoft-Windows-PowerShell/Operational alongside it rather than replacing it. The classic log is present and enabled by default, and it records four event IDs:

  • 400: engine state changed to Available, meaning a PowerShell host started
  • 403: engine state changed to Stopped, meaning the host exited
  • 600: provider lifecycle, for providers such as Registry or Certificate
  • 800: pipeline execution details

Why it matters in investigations

Because it needs no policy, the classic log is frequently the only PowerShell evidence on hosts without Script Block Logging. Events 400 and 403 bracket the lifetime of each PowerShell host, and their detail block carries HostApplication: the full command line that started it. That is where an -EncodedCommand, a -WindowStyle Hidden or a -Version 2 downgrade shows up. EngineVersion confirms which engine actually ran, and event 800 records the command line of each pipeline, often the best record of what ran when 4104 is absent.

Example

The detail block of an event 400 is a list of Key=Value lines:

NewEngineState=Available
PreviousEngineState=None
HostName=ConsoleHost
HostVersion=5.1.19041.4648
HostApplication=powershell.exe -nop -w hidden -enc VwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAnAHMAeQBuAHQAaABlAHQAaQBjACAAcwBhAG0AcABsAGUAJwA=
EngineVersion=5.1.19041.4648
RunspaceId=...

The parser splits these lines into sortable fields, decodes the encoded command in HostApplication and flags the hidden window. For event 400 or 403 with an EngineVersion of 2.x, it raises a downgrade finding.

Merge the classic log with the Operational log in the PowerShell Parser, and see the PowerShell event-log guide for what each event ID proves.