detection.wiki

IIS: WWW Isapi Extension

EventTitleChannelSampleRule
1IsapiCallExtensionETW TraceNN
2IsapiExtensionDoneETW TraceNN
3IsapiNotifyCompletionETW TraceNN

Event ID 1: IsapiCallExtension

#
Channel
ETW Trace
Source
Trace

Fields #

NameDescription
ContextId mof:Object
DllName mof:String

Event ID 2: IsapiExtensionDone

#
Channel
ETW Trace
Source
Trace

Fields #

NameDescription
ContextId mof:Object

Event ID 3: IsapiNotifyCompletion

#
Channel
ETW Trace
Source
Trace

Fields #

NameDescription
ContextId mof:Object

Provenance

ETW provider GUID {A1C2040E-8840-4C31-BA11-9871031A19EA}

  • WS2025-26100.0, schema read from the WMI MOF class, captured 2026-02-26

    Taken from Windows installation media (build 26100.1), not a patched system, so the exact update level is unknown.

  • WS2022-20348.4893, schema read from the WMI MOF class, captured 2026-06-02

    MOF class: IIS_IsapiTrace