600 PowerShell log · Provider Lifecycle low severity medium volume

PowerShell Event ID 600 — PowerShell provider started

A PowerShell provider was loaded. ProviderName is key (e.g., Registry, FileSystem, WSMan, Certificate).

Why event 600 matters

WSMan provider loading = remoting/WinRM activity. Certificate provider = possible cert manipulation. Registry provider = registry access through PowerShell.

How to detect it

Alert: unusual providers loaded in non-interactive PowerShell sessions. WSMan provider in hidden sessions signals remoting.

Log source
Microsoft-Windows-PowerShell/Operational
Enable PowerShell Module Logging and Script Block Logging via GPO (Administrative Templates → Windows PowerShell).
Fields to pivot on
ScriptBlockTextPathHostApplication

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL
Event
| where EventLog == "Microsoft-Windows-PowerShell/Operational" and EventID == 600   // PowerShell provider started
// EventData holds: ScriptBlockText, Path, HostApplication
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Microsoft-Windows-PowerShell/Operational" EventCode=600
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# PowerShell provider started — add EventData fields: ScriptBlockText, Path, HostApplication`
Hunt event 600 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Frequently asked questions

What is PowerShell Event ID 600?

PowerShell provider started. A PowerShell provider was loaded. ProviderName is key (e.g., Registry, FileSystem, WSMan, Certificate).

Which log records event 600?

Event 600 is written to the Microsoft-Windows-PowerShell/Operational channel by Microsoft-Windows-PowerShell. Enable PowerShell Module Logging and Script Block Logging via GPO (Administrative Templates → Windows PowerShell).

How do you detect activity around event 600?

Alert: unusual providers loaded in non-interactive PowerShell sessions. WSMan provider in hidden sessions signals remoting.