WinEvent.ps1

Lock/screensaver

Workstation was locked
Get-WinEvent -FilterHashtable @{ LogName='security'; Id='4800' }
Workstation was unlocked
Get-WinEvent -FilterHashtable @{ LogName='security'; Id='4801' }
Screensaved invoked
Get-WinEvent -FilterHashtable @{ LogName='security'; Id='4802' }
Screensaver dismissed
Get-WinEvent -FilterHashtable @{ LogName='security'; Id='4803' }


System ON/OFF

Windows is starting up
Get-WinEvent -FilterHashtable @{ LogName='security'; Id='4608' }
System uptime
Get-WinEvent -FilterHashtable @{ LogName='system'; Id='6013' }
Windows is shutting down
Get-WinEvent -FilterHashtable @{ LogName='security'; Id='4609' }
System has been shut down
Get-WinEvent -FilterHashtable @{ LogName='system'; Id='1074' }


System sleep/awake

System entering sleep mode
Get-WinEvent -FilterHashtable @{ LogName='system'; Id=42 }
System returning from sleep
Get-WinEvent -FilterHashtable @{ LogName='system'; Id='1'; ProviderName = "Microsoft-Windows-Power-Troubleshooter" }


Logons

Successful logons
Get-WinEvent -FilterHashtable @{ LogName='Security'; Id='4624' }
Logons with explicit credentials
Get-WinEvent -FilterHashtable @{ LogName='Security'; Id='4648' }
Account logoffs
Get-WinEvent -FilterHashtable @{ LogName='security'; Id='4634' }


Access

Outbound RDP
Get-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-TerminalServices-RDPClient/Operational'; id='1024' } | select timecreated, message | ft -AutoSize -Wrap
Inbound RDP
Get-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-TerminalServices-LocalSessionManager/Operational'; id='21' } | select timecreated, message | ft -AutoSize -Wrap
Outbound WinRM
Get-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-WinRM/Operational'; id=6 }

Get-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-WinRM/Operational'; id=80 }
Inbound WinRM
Get-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-WinRM/Operational'; id=91 }

Get-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-WMI-Activity/Operational'; id=5857 } | ? {$_.message -match 'Win32_WIN32_TERMINALSERVICE_Prov|CIMWin32'}


Activity

Attempt to install a service
Get-WinEvent -FilterHashtable @{ LogName='Security'; Id='4697' }
Scheduled task created
Get-WinEvent -FilterHashtable @{ LogName='security'; Id='4698' }
Scheduled task updated
Get-WinEvent -FilterHashtable @{ LogName='security'; Id='4702' }
Sysinternals usage?
Get-ItemProperty 'HKCU:\SOFTWARE\Sysinternals\*' | select PSChildName, EulaAccepted


Security

LSASS started as a protected process
Get-WinEvent -FilterHashtable @{ LogName='system'; Id='12' ; ProviderName='Microsoft-Windows-Wininit' }