Desktop Window Manager

Event	Title	Channel	Sample	Rule
9003	Event ID 9003	Application	Y	N
9004	Event ID 9004	Application	Y	N
9007	Event ID 9007	Application	Y	N
9009	The Desktop Window Manager has exited with code (0x40010004)	Application	Y	N
9016	Event ID 9016	Application	Y	N
9027	The Desktop Window Manager has registered the session port.	Application	Y	N

Event ID 9003

Channel: Application
Level: Informational

Example Event #

{
  "system": {
    "provider": "Desktop Window Manager",
    "guid": "",
    "event_source_name": "",
    "event_id": 9003,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2013-10-23T16:22:49+00:00",
    "event_record_id": 88,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "IE8Win7",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Event ID 9004

Channel: Application
Level: Informational

Example Event #

{
  "system": {
    "provider": "Desktop Window Manager",
    "guid": "",
    "event_source_name": "",
    "event_id": 9004,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2013-10-23T17:51:20+00:00",
    "event_record_id": 234,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "IE8Win7",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Event ID 9007

Channel: Application
Level: Informational

Example Event #

{
  "system": {
    "provider": "Desktop Window Manager",
    "guid": "",
    "event_source_name": "",
    "event_id": 9007,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2014-11-26T23:22:01.000000Z",
    "event_record_id": 1151,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "IE10Win7",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {}
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 9009: The Desktop Window Manager has exited with code (0x40010004)

Channel: Application
Level: Informational

Fields #

Name	Description
`Data`

Example Event #

{
  "system": {
    "provider": "Desktop Window Manager",
    "guid": "",
    "event_source_name": "",
    "event_id": 9009,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2013-10-23T17:45:45+00:00",
    "event_record_id": 208,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "IE8Win7",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": [
      "0x40010004"
    ]
  },
  "message": "The Desktop Window Manager has exited with code (0x40010004)"
}

References #

Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Event ID 9016

Channel: Application
Level: Informational

Example Event #

{
  "system": {
    "provider": "Desktop Window Manager",
    "guid": "",
    "event_source_name": "",
    "event_id": 9016,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2014-11-26T23:26:01.000000Z",
    "event_record_id": 1211,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "IE10Win7",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {}
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 9027: The Desktop Window Manager has registered the session port.

Channel: Application
Level: Informational

Example Event #

{
  "system": {
    "provider": "Desktop Window Manager",
    "guid": "",
    "event_source_name": "",
    "event_id": 9027,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2022-04-07T16:53:28.968520+00:00",
    "event_record_id": 194,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "The Desktop Window Manager has registered the session port."
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline