Querying EVTX with PowerShell: Get-WinEvent, FilterHashtable and XPath
A practical guide to reading .evtx files with PowerShell — Get-WinEvent vs Get-EventLog, the fast FilterHashtable path, XPath filters for EventData fields, FilterXml, and the limitations that trip people up.