Pipeline execution details. Contains HostName, RunspaceId, and pipeline details for PowerShell v2/3 without module logging.
Some execution details visible even without full module logging (Event 4103). May capture abbreviated command details.
Low priority when 4103/4104 are enabled. Use as fallback for environments without full PowerShell logging.
ScriptBlockTextPathHostApplication Starting points — adapt the log source, projected fields and thresholds for your environment.
Event
| where EventLog == "Microsoft-Windows-PowerShell/Operational" and EventID == 800 // Pipeline execution details
// EventData holds: ScriptBlockText, Path, HostApplication
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Microsoft-Windows-PowerShell/Operational" EventCode=800
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# Pipeline execution details — add EventData fields: ScriptBlockText, Path, HostApplication`Pipeline execution details. Pipeline execution details. Contains HostName, RunspaceId, and pipeline details for PowerShell v2/3 without module logging.
Event 800 is written to the Microsoft-Windows-PowerShell/Operational channel by Microsoft-Windows-PowerShell. Enable PowerShell Module Logging and Script Block Logging via GPO (Administrative Templates → Windows PowerShell).
Low priority when 4103/4104 are enabled. Use as fallback for environments without full PowerShell logging.