Example custom event view I used to display only relevant PowerShell logs for a demo

powershell_structured_query.xml

<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">
      *[System[(EventID='4688')]]
      and
      *[EventData[Data[@Name='NewProcessName']='C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe']]
    </Select>
    <Select Path="Microsoft-Windows-PowerShell/Operational">
      *[System[(EventID='4104')]]
      and
      *[EventData[Data[@Name='ScriptBlockText']!='$global:?']]
      and
      *[EventData[Data[@Name='ScriptBlockText']!=". 'C:\Windows\System32\WindowsPowerShell\v1.0\profile.ps1'"]]
      and
      *[EventData[Data[@Name='Path']!='C:\Windows\System32\WindowsPowerShell\v1.0\profile.ps1']]
    </Select>
    <Select Path="Microsoft-Windows-Sysmon/Operational">
      *[System[(EventID='1')]]
      and
      *[EventData[Data[@Name='Image']='C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe']]
    </Select>
  </Query>
</QueryList>