Posts tagged "{tag}"

Posts tagged "{tag}": #powershell

6/17/2026

Querying EVTX with PowerShell: Get-WinEvent, FilterHashtable and XPath

A practical guide to reading .evtx files with PowerShell — Get-WinEvent vs Get-EventLog, the fast FilterHashtable path, XPath filters for EventData fields, FilterXml, and the limitations that trip people up.

evtx dfir powershell how-to

5/27/2026

PowerShell logging: what you get with module and script block logging on

The practical difference between PowerShell module logging, script block logging, transcripts, and AMSI buffers — and the GPO settings that actually turn the useful ones on.

evtx powershell dfir logging