PowerShell Event ID 400 — PowerShell engine started — SecOps Tools

Why event 400 matters

Downgrade attacks: attackers invoke PowerShell v2 (EngineVersion 2.0) to bypass Script Block Logging (introduced in v5). HostName=ConsoleHost means interactive/command-line. HostName values like 'ServerRemoteHost' indicate WinRM/remote PowerShell.

How to detect it

Alert: EngineVersion=2.0 (PowerShell v2 invocation — bypasses script block logging). Alert: HostName=ServerRemoteHost from unexpected source hosts. Correlate with 4688 parent process.

Log source

Microsoft-Windows-PowerShell/Operational

Enable PowerShell Module Logging and Script Block Logging via GPO (Administrative Templates → Windows PowerShell).

Fields to pivot on

ScriptBlockTextPathHostApplication

MITRE ATT&CK mapping

Tactic	Technique
Defense Evasion	PowerShell (T1059.001)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule

title: PowerShell Version 2 Invocation — Logging Bypass
status: stable
description: PowerShell v2 started — bypasses Script Block Logging
author: theadminstack.com
date: 2026/05/16
logsource:
    product: windows
    service: powershell-classic
detection:
    selection:
        EventID: 400
        EngineVersion|startswith: '2.'
    condition: selection
falsepositives:
    - Legacy scripts requiring PowerShell v2
level: high
tags:
    - attack.defense_evasion
    - attack.execution
    - attack.t1059.001

Sentinel / Defender KQL

Event
| where EventLog == "Microsoft-Windows-PowerShell/Operational" and EventID == 400   // PowerShell engine started
// EventData holds: ScriptBlockText, Path, HostApplication
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc

Splunk SPL

index=* sourcetype="WinEventLog:Microsoft-Windows-PowerShell/Operational" EventCode=400
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# PowerShell engine started — add EventData fields: ScriptBlockText, Path, HostApplication`

Hunt event 400 in Sentinel/Defender →

Build a KQL query for this event in the KQL Query Builder.

Search all event IDs →

Open the interactive Windows Event ID lookup.

Related Engine Lifecycle events

403 PowerShell engine stopped

Frequently asked questions

What is PowerShell Event ID 400?

PowerShell engine started. PowerShell engine was started. HostName and EngineVersion are key. Logged to the Windows PowerShell log (not Operational).

Which log records event 400?

Event 400 is written to the Microsoft-Windows-PowerShell/Operational channel by Microsoft-Windows-PowerShell. Enable PowerShell Module Logging and Script Block Logging via GPO (Administrative Templates → Windows PowerShell).

What MITRE ATT&CK techniques map to event 400?

Event 400 is associated with: PowerShell (T1059.001).

How do you detect activity around event 400?

Alert: EngineVersion=2.0 (PowerShell v2 invocation — bypasses script block logging). Alert: HostName=ServerRemoteHost from unexpected source hosts. Correlate with 4688 parent process.