Microsoft-Antimalware-Engine

Event	Title	Channel	Sample	Rule
1	Start of engine scan request	Application	Y	N
2	End of engine scan request	Application	Y	N
3	Message	Application	Y	N
4	Versions	Application	Y	N
5	Start of stream scan request	Application	Y	N
6	End of stream scan request	Application	Y	N
7	Skipped file	Application	Y	N
8	Behavior Monitoring	Application	N	N
9	Behavior Monitoring	Application	N	N
10	Behavior Monitoring	Application	N	N
11	Behavior Monitoring	Application	Y	N
12	Behavior Monitoring	Application	N	N
13	Behavior Monitoring	Application	N	N
14	Behavior Monitoring	Application	N	N
15	Behavior Monitoring	Application	Y	N
16	Behavior Monitoring	Application	Y	N
17	Behavior Monitoring	Application	N	N
18	Behavior Monitoring	Application	N	N
19	Behavior Monitoring	Application	N	N
20	Behavior Monitoring	Application	N	N
21	Behavior Monitoring	Application	N	N
22	Behavior Monitoring	Application	N	N
23	Behavior Monitoring	Application	N	N
24	Behavior Monitoring	Application	N	N
25	Behavior Monitoring	Application	N	N
26	Behavior Monitoring	Application	Y	N
27	Behavior Monitoring	Application	N	N
28	Behavior Monitoring	Application	N	N
29	Behavior Monitoring	Application	Y	N
30	UfsScanFileTask	Application	Y	N
31	UfsScanFileTask	Application	Y	N
32	UfsScanProcTaskStart_V2	Application	N	N
33	UfsScanProcTaskStop_V3	Application	N	N
35	Cache	Application	Y	N
36	Cache	Application	Y	N
37	Cache	Application	Y	N
38	Cache	Application	Y	N
39	Cache	Application	N	N
40	PersistedStoreTaskPersistedStoreAction	Application	N	N
41	PersistedStoreTaskPersistedStoreMaintenance	Application	N	N
42	PersistedStoreTaskPersistedStoreAnalyzeFile	Application	N	N
43	ExpensiveOperationTask	Application	Y	N
44	MetaStoreTask	Application	Y	N
45	MetaStoreTaskMetaStoreMaintenance	Application	N	N
46	Behavior Monitoring	Application	N	N
47	Behavior Monitoring	Application	N	N
48	Behavior Monitoring	Application	N	N
49	Behavior Monitoring	Application	N	N
50	Behavior Monitoring	Application	N	N
51	Behavior Monitoring	Application	N	N
52	Behavior Monitoring	Application	N	N
53	Behavior Monitoring	Application	Y	N
58	Behavior Monitoring	Application	N	N
59	Message	Application	Y	N
60	Behavior Monitoring	Application	Y	N
61	Behavior Monitoring	Application	Y	N
62	Behavior Monitoring	Application	Y	N
63	Behavior Monitoring	Application	Y	N
64	Behavior Monitoring	Application	N	N
65	Behavior Monitoring	Application	N	N
66	Behavior Monitoring	Application	N	N
67	ExpensiveOperationTask	Application	Y	N
68	Message	Application	N	N
69	Message	Application	N	N
70	Behavior Monitoring	Application	Y	N
71	Behavior Monitoring	Application	Y	N
72	Behavior Monitoring	Application	Y	N
73	Behavior Monitoring	Application	Y	N
74	SenseRemediationTask	Application	N	N
75	Message	Application	N	N
76	SenseHeartbeatTask	Application	Y	N
77	SmsScanTaskSmsRequestMonitorProcessId	Application	Y	N
78	SmsScanTaskSmsRequestMonitorFilePath	Application	N	N
79	SmsScanTaskSmsMonitoringStart	Application	Y	N
80	SmsScanTaskSmsMonitoringStop	Application	N	N
81	SmsScanTaskSmsScanStart	Application	Y	N
82	SmsScanTaskSmsScanStop	Application	Y	N
83	StartRundownTaskStart	Application	N	N
84	StartRundownTaskStop	Application	N	N
85	EndRundownTaskStart	Application	N	N
86	EndRundownTaskStop	Application	N	N
87	EngineTaskStart	Application	N	N
88	EngineTaskStop	Application	N	N
89	EngineTaskDCStart	Application	N	N
90	EngineTaskDCStop	Application	N	N
91	UfsScanFileTaskDCStart_V1	Application	N	N
92	UfsScanFileTaskDCStop_V1	Application	N	N
93	UfsScanProcTaskDCStart_V1	Application	N	N
94	UfsScanProcTaskDCStop_V1	Application	N	N
95	Behavior Monitoring	Application	Y	N
96	SenseOnboardingInfoTask	Application	N	N
97	Scan request	Application	N	N
98	Scan request	Application	N	N
99	Behavior Monitoring	Application	N	N
100	Behavior Monitoring	Application	N	N
101	EngineLoadTaskStart	Application	N	N
102	EngineLoadTaskStop	Application	N	N
103	Behavior Monitoring	Application	N	N
104	Behavior Monitoring	Application	Y	N
105	Behavior Monitoring	Application	Y	N
106	Behavior Monitoring	Application	N	N
107	Behavior Monitoring	Application	N	N
108	SenseExclusionTask	Application	N	N
109	Behavior Monitoring	Application	Y	N
110	Behavior Monitoring	Application	Y	N
111	Behavior Monitoring	Application	Y	N
112	Behavior Monitoring	Application	Y	N
113	Behavior Monitoring	Application	Y	N
114	Behavior Monitoring	Application	Y	N
115	BehaviorMonitoringBmDbChanged	Application	N	N

Event ID 1: Start of engine scan request

Channel: Application
Level: Informational
Task: Scanrequest
Opcode: Start

Fields #

Name	Description
`EngineId` Pointer
`Id` UInt8
`Type` AnsiString
`Flags` HexInt32
`ScanSource` UInt32
`ResourceCount` UInt32
`FirstResourceType` UnicodeString
`FirstResourcePath` UnicodeString
`ThreadTime` FILETIME

Example Event #

{
  "system": {
    "channel": "Application",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 1,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 6908
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Antimalware-Engine",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:14:27.813Z",
    "version": 0
  },
  "event_data": {
    "EngineId": "0x7FFE4A9A0000",
    "First Resource Path": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
    "First Resource Type": "file",
    "Flags": "04000000",
    "Id": 240,
    "Resource Count": 1,
    "Scan Source": 30,
    "ThreadTime": "1601-01-01 00:00:14.593Z",
    "Type": "\u0015Ô”[m&\u000bC\u0001\u001fEResource"
  },
  "message": ""
}

Example keys not documented in the fields table: First Resource Path, First Resource Type, Resource Count, Scan Source

Event ID 2: End of engine scan request

Channel: Application
Level: Informational
Task: Scanrequest
Opcode: Stop

Fields #

Name	Description
`EngineId` Pointer
`Id` UInt8
`Type` AnsiString
`Flags` HexInt32
`ScanSource` UInt32
`ResourceCount` UInt32
`FirstResourceType` UnicodeString
`FirstResourcePath` UnicodeString
`ThreadTime` FILETIME
`StartQPC` UInt64

Example Event #

{
  "system": {
    "channel": "Application",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 2,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 6908
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Antimalware-Engine",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:14:27.818Z",
    "version": 0
  },
  "event_data": {
    "EngineId": "0x7FFE4A9A0000",
    "First Resource Path": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
    "First Resource Type": "file",
    "Flags": "04000000",
    "Id": 240,
    "Resource Count": 1,
    "Scan Source": 30,
    "StartQPC": 817995506045,
    "ThreadTime": "1601-01-01 00:00:14.609Z",
    "Type": "\u0015Ô”[m&\u000bC\u0001\u001fEResource"
  },
  "message": ""
}

Example keys not documented in the fields table: First Resource Path, First Resource Type, Resource Count, Scan Source

Event ID 3: Message

Channel: Application
Also via: realtime ETW trace
Level: Informational
Task: Message
Opcode: win:Info

Fields #

Name	Description
`Message` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Antimalware-Engine",
    "guid": "{0A002690-3839-4E3A-B3B6-96D8DF868D99}",
    "event_source_name": "",
    "event_id": 3,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:20:53.152+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3756,
      "thread_id": 13108
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Message": "C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\fabb9e10f6808e7fbef2496dc4f4b9a2\\Microsoft.WSMan.Management.ni.dll : CI bit is set, but level is too low. Level: 2"
  },
  "message": "GenericMessageTask"
}

Event ID 4: Versions

Channel: Application
Also via: realtime ETW trace
Level: Informational
Task: Versions
Opcode: win:Info

Fields #

Name	Description
`EngineVersion` UnicodeString
`AVVersion` UnicodeString
`ASVersion` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Antimalware-Engine",
    "guid": "{0A002690-3839-4E3A-B3B6-96D8DF868D99}",
    "event_source_name": "",
    "event_id": 4,
    "version": 0,
    "level": 4,
    "task": 3,
    "opcode": 0,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:18:28.322+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 4712,
      "thread_id": 16152
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AS Version": "1.451.223.0",
    "AV Version": "1.451.223.0",
    "Engine Version": "1.1.26040.8"
  },
  "message": "VersionTask"
}

Example keys not documented in the fields table: AS Version, AV Version, Engine Version

Event ID 5: Start of stream scan request

Channel: Application
Also via: realtime ETW trace
Level: Informational
Task: Streamscanrequest
Opcode: Start

Fields #

Name	Description
`Id` UInt32
`Path` UnicodeString
`Process` UnicodeString
`Reason` UInt32
`ThreadTime` FILETIME
`PID` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Antimalware-Engine",
    "guid": "{0A002690-3839-4E3A-B3B6-96D8DF868D99}",
    "event_source_name": "",
    "event_id": 5,
    "version": 1,
    "level": 4,
    "task": 4,
    "opcode": 1,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:20:52.988+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{C3AAE106-E766-4DFA-9E19-A815726CDA4D}"
    },
    "execution": {
      "process_id": 3756,
      "thread_id": 4400
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Id": 477820198,
    "PID": 11608,
    "Path": "\\Device\\HarddiskVolume4\\Users\\localuser\\AppData\\Local\\Temp\\__PSScriptPolicyTest_i3yqwsnl.1tp.ps1",
    "Process": "\\Device\\HarddiskVolume4\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
    "Reason": 2,
    "ThreadTime": "1601-01-01 00:01:27.187Z"
  },
  "message": "StreamScanRequestTask"
}

Event ID 6: End of stream scan request

Channel: Application
Also via: realtime ETW trace
Level: Informational
Task: Streamscanrequest
Opcode: Stop

Fields #

Name	Description
`Id` UInt32
`Path` UnicodeString
`Process` UnicodeString
`Reason` UInt32
`ThreadTime` FILETIME
`PID` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Antimalware-Engine",
    "guid": "{0A002690-3839-4E3A-B3B6-96D8DF868D99}",
    "event_source_name": "",
    "event_id": 6,
    "version": 1,
    "level": 4,
    "task": 4,
    "opcode": 2,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:20:52.991+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{C3AAE106-E766-4DFA-9E19-A815726CDA4D}"
    },
    "execution": {
      "process_id": 3756,
      "thread_id": 4400
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Id": 477820198,
    "PID": 11608,
    "Path": "\\Device\\HarddiskVolume4\\Users\\localuser\\AppData\\Local\\Temp\\__PSScriptPolicyTest_i3yqwsnl.1tp.ps1",
    "Process": "\\Device\\HarddiskVolume4\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
    "Reason": 2,
    "ThreadTime": "1601-01-01 00:01:27.187Z"
  },
  "message": "StreamScanRequestTask"
}

Event ID 7: Skipped file

Channel: Application
Also via: realtime ETW trace
Level: Informational
Task: Skippedfile
Opcode: win:Info

Fields #

Name	Description
`Path` UnicodeString
`Reason` AnsiString

Example Event #

{
  "system": {
    "provider": "Microsoft-Antimalware-Engine",
    "guid": "{0A002690-3839-4E3A-B3B6-96D8DF868D99}",
    "event_source_name": "",
    "event_id": 7,
    "version": 0,
    "level": 4,
    "task": 5,
    "opcode": 0,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:20:53.580+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{7D77A037-82FB-4E65-B66C-86F3AA5440F9}"
    },
    "execution": {
      "process_id": 3756,
      "thread_id": 4400
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Path": "\\Device\\HarddiskVolume4\\Windows\\System32\\en-US\\logman.exe.mui",
    "Reason": "Log skip"
  },
  "message": "SkippedFileTask"
}

Event ID 8: Behavior Monitoring

Channel: Application
Task: BehaviorMonitoring
Opcode: BmDetection

Fields #

Name	Description
`PID` UInt32
`GUID` GUID
`Type` UInt32
`Name` UnicodeString
`SignatureId` HexInt64
`ImagePath` UnicodeString

Event ID 9: Behavior Monitoring

Channel: Application
Task: BehaviorMonitoring
Opcode: BmProcessStart

Fields #

Name	Description
`PID` UInt32
`PPID` UInt32
`ImagePath` UnicodeString
`Flags` HexInt32

Event ID 10: Behavior Monitoring

Channel: Application
Task: BehaviorMonitoring
Opcode: BmDriverLoad

Fields #

Name	Description
`PID` UInt32
`ImagePath` UnicodeString

Event ID 11: Behavior Monitoring

Channel: Application
Also via: realtime ETW trace
Level: Informational
Task: BehaviorMonitoring
Opcode: BmModuleLoad

Fields #

Name	Description
`PID` UInt32
`ImagePath` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Antimalware-Engine",
    "guid": "{0A002690-3839-4E3A-B3B6-96D8DF868D99}",
    "event_source_name": "",
    "event_id": 11,
    "version": 0,
    "level": 4,
    "task": 6,
    "opcode": 13,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:20:52.924+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3756,
      "thread_id": 8752
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ImagePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\win32u.dll",
    "PID": 14912
  },
  "message": "BehaviorMonitorTask"
}

Event ID 12: Behavior Monitoring

Channel: Application
Task: BehaviorMonitoring
Opcode: BmDocumentOpen

Fields #

Name	Description
`PID` UInt32
`ImageName` UnicodeString
`FileName` UnicodeString

Event ID 13: Behavior Monitoring

Channel: Application
Task: BehaviorMonitoring
Opcode: BmFileCreate

Fields #

Name	Description
`PID` UInt32
`FileName` UnicodeString

Event ID 14: Behavior Monitoring

Channel: Application
Task: BehaviorMonitoring
Opcode: BmFileChange

Fields #

Name	Description
`PID` UInt32
`FileName` UnicodeString

Event ID 15: Behavior Monitoring

Channel: Application
Also via: realtime ETW trace
Level: Informational
Task: BehaviorMonitoring
Opcode: BmFileDelete

Fields #

Name	Description
`PID` UInt32
`FileName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Antimalware-Engine",
    "guid": "{0A002690-3839-4E3A-B3B6-96D8DF868D99}",
    "event_source_name": "",
    "event_id": 15,
    "version": 0,
    "level": 4,
    "task": 6,
    "opcode": 17,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T04:00:01.310+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3756,
      "thread_id": 5168
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "FileName": "\\Device\\HarddiskVolume4\\Windows\\System32\\LogFiles\\WMI\\RtBackup\\EtwRTAdmin_PS_Provider.etl",
    "PID": 4
  },
  "message": "BehaviorMonitorTask"
}

Event ID 16: Behavior Monitoring

Channel: Application
Level: Informational
Task: BehaviorMonitoring
Opcode: BmFileRename

Fields #

Name	Description
`PID` UInt32
`FileName` UnicodeString
`OldFileName` UnicodeString

Example Event #

{
  "system": {
    "channel": "Application",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 16,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 428
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 18,
    "provider": "Microsoft-Antimalware-Engine",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:14:00.019Z",
    "version": 0
  },
  "event_data": {
    "FileName": "\\Device\\HarddiskVolume4\\Windows\\System32\\sru\\SRU.log",
    "OldFileName": "\\Device\\HarddiskVolume4\\Windows\\System32\\sru\\SRUtmp.log",
    "PID": 1920
  },
  "message": ""
}

Event ID 17: Behavior Monitoring

Channel: Application
Task: BehaviorMonitoring
Opcode: BmRegistryKeyCreate

Fields #

Name	Description
`PID` UInt32
`KeyPath` UnicodeString

Event ID 18: Behavior Monitoring

Channel: Application
Task: BehaviorMonitoring
Opcode: BmRegistryKeyRename

Fields #

Name	Description
`PID` UInt32
`KeyPath` UnicodeString

Event ID 19: Behavior Monitoring

Channel: Application
Task: BehaviorMonitoring
Opcode: BmRegistryKeyDelete

Fields #

Name	Description
`PID` UInt32
`KeyPath` UnicodeString

Event ID 20: Behavior Monitoring

Channel: Application
Task: BehaviorMonitoring
Opcode: BmRegistryValueSet

Fields #

Name	Description
`PID` UInt32
`KeyPath` UnicodeString
`ValueName` UnicodeString

Event ID 21: Behavior Monitoring

Channel: Application
Task: BehaviorMonitoring
Opcode: BmRegistryValueDelete

Fields #

Name	Description
`PID` UInt32
`KeyPath` UnicodeString
`ValueName` UnicodeString

Event ID 22: Behavior Monitoring

Channel: Application
Task: BehaviorMonitoring
Opcode: BmNetworkConnect

Fields #

Name	Description
`PID` UInt32

Event ID 23: Behavior Monitoring

Channel: Application
Task: BehaviorMonitoring
Opcode: BmNetworkData

Fields #

Name	Description
`PID` UInt32

Event ID 24: Behavior Monitoring

Channel: Application
Task: BehaviorMonitoring
Opcode: BmNetworkListen

Fields #

Name	Description
`PID` UInt32

Event ID 25: Behavior Monitoring

Channel: Application
Task: BehaviorMonitoring
Opcode: BmNetworkAccept

Fields #

Name	Description
`PID` UInt32

Event ID 26: Behavior Monitoring

Channel: Application
Also via: realtime ETW trace
Level: Informational
Task: BehaviorMonitoring
Opcode: BmProcessTerminate

Fields #

Name	Description
`PID` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Antimalware-Engine",
    "guid": "{0A002690-3839-4E3A-B3B6-96D8DF868D99}",
    "event_source_name": "",
    "event_id": 26,
    "version": 0,
    "level": 4,
    "task": 6,
    "opcode": 28,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:20:53.178+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3756,
      "thread_id": 8752
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "PID": 15580
  },
  "message": "BehaviorMonitorTask"
}

Event ID 27: Behavior Monitoring

Channel: Application
Task: BehaviorMonitoring
Opcode: BmNetworkDetection

Fields #

Name	Description
`PID` UInt32
`DetectionId` HexInt64

Event ID 28: Behavior Monitoring

Channel: Application
Task: BehaviorMonitoring
Opcode: BmBootRecordChange

Fields #

Name	Description
`PID` UInt32
`RecordType` UInt32
`ImagePath` UnicodeString
`Path` UnicodeString

Event ID 29: Behavior Monitoring

Channel: Application
Level: Informational
Task: BehaviorMonitoring
Opcode: BmRemoteThreadCreate

Fields #

Name	Description
`PID` UInt32
`TPID` UInt32
`TTID` UInt32
`ImageName` UnicodeString

Example Event #

{
  "system": {
    "channel": "Application",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 29,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 8448
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 31,
    "provider": "Microsoft-Antimalware-Engine",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:13:24.259Z",
    "version": 0
  },
  "event_data": {
    "ImageName": "\\Device\\HarddiskVolume4\\PPLRunner\\sealighter.exe",
    "PID": 4224,
    "TPID": 10988,
    "TTID": 12384
  },
  "message": ""
}

Event ID 30: UfsScanFileTask

Channel: Application
Also via: realtime ETW trace
Level: Informational
Task: UfsScanFileTask
Opcode: Start

Fields #

Name	Description
`EngineId` Pointer
`FilePath` UnicodeString
`ThreadTime` FILETIME

Example Event #

{
  "system": {
    "provider": "Microsoft-Antimalware-Engine",
    "guid": "{0A002690-3839-4E3A-B3B6-96D8DF868D99}",
    "event_source_name": "",
    "event_id": 30,
    "version": 2,
    "level": 4,
    "task": 17,
    "opcode": 1,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T04:10:23.756+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3756,
      "thread_id": 10388
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "EngineId": "0x7FFCAC8D0000",
    "FilePath": "C:\\Windows\\System32\\csrss.exe",
    "ThreadTime": "1601-01-01 00:00:13.781Z"
  },
  "message": "UfsScanFileTask"
}

Event ID 31: UfsScanFileTask

Channel: Application
Also via: realtime ETW trace
Level: Informational
Task: UfsScanFileTask
Opcode: Stop

Fields #

Name	Description
`EngineId` Pointer
`FilePath` UnicodeString
`ThreadTime` FILETIME
`StartQPC` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Antimalware-Engine",
    "guid": "{0A002690-3839-4E3A-B3B6-96D8DF868D99}",
    "event_source_name": "",
    "event_id": 31,
    "version": 3,
    "level": 4,
    "task": 17,
    "opcode": 2,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T04:10:23.759+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{2B9B7F01-B456-4101-B35E-FBBF789E6ADF}"
    },
    "execution": {
      "process_id": 3756,
      "thread_id": 10388
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "EngineId": "0x7FFCAC8D0000",
    "FilePath": "C:\\Windows\\System32\\csrss.exe",
    "StartQPC": 1166334107702,
    "ThreadTime": "1601-01-01 00:00:13.781Z"
  },
  "message": "UfsScanFileTask"
}

Event ID 32: UfsScanProcTaskStart_V2

Channel: Application
Task: UfsScanProcTask
Opcode: Start

Fields #

Name	Description
`EngineId` Pointer
`FilePath` UnicodeString
`PID` UInt32
`ThreadTime` FILETIME

Event ID 33: UfsScanProcTaskStop_V3

Channel: Application
Task: UfsScanProcTask
Opcode: Stop

Fields #

Name	Description
`EngineId` Pointer
`FilePath` UnicodeString
`PID` UInt32
`ThreadTime` FILETIME
`StartQPC` UInt64

Event ID 35: Cache

Channel: Application
Level: Informational
Task: Cache
Opcode: MOACAdd

Fields #

Name	Description
`ScanSource` UInt32
`EventType` UInt32
`Classification` UInt32
`Info` UnicodeString
`FileName` UnicodeString
`FileID` UInt32
`FileUSN` UInt32
`Result` HexInt32

Example Event #

{
  "system": {
    "channel": "Application",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 35,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 7292
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 34,
    "provider": "Microsoft-Antimalware-Engine",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:13:26.373Z",
    "version": 0
  },
  "event_data": {
    "Classification": 1,
    "EventType": 55,
    "FileID": 94286,
    "FileName": "C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\StableEngineEtwLocation\\mpengine_etw.dll",
    "FileUSN": 2592769736,
    "Info": "SigSeq: 0x000017701308205F",
    "Result": "00000000",
    "ScanSource": 3
  },
  "message": ""
}

Event ID 36: Cache

Channel: Application
Also via: realtime ETW trace
Level: Informational
Task: Cache
Opcode: MOACLookup

Fields #

Name	Description
`ScanSource` UInt32
`EventType` UInt32
`Classification` UInt32
`Info` UnicodeString
`FileName` UnicodeString
`FileID` UInt32
`FileUSN` UInt32
`Result` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Antimalware-Engine",
    "guid": "{0A002690-3839-4E3A-B3B6-96D8DF868D99}",
    "event_source_name": "",
    "event_id": 36,
    "version": 0,
    "level": 4,
    "task": 7,
    "opcode": 35,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:20:52.923+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3756,
      "thread_id": 1744
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Classification": 1,
    "EventType": 56,
    "FileID": 62386,
    "FileName": "C:\\Windows\\System32\\psapi.dll",
    "FileUSN": 44610216,
    "Info": "",
    "Result": "01800000",
    "ScanSource": 0
  },
  "message": "CacheTask"
}

Event ID 37: Cache

Channel: Application
Also via: realtime ETW trace
Level: Informational
Task: Cache
Opcode: MOACRevoke

Fields #

Name	Description
`ScanSource` UInt32
`EventType` UInt32
`Classification` UInt32
`Info` UnicodeString
`FileName` UnicodeString
`FileID` UInt32
`FileUSN` UInt32
`Result` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Antimalware-Engine",
    "guid": "{0A002690-3839-4E3A-B3B6-96D8DF868D99}",
    "event_source_name": "",
    "event_id": 37,
    "version": 0,
    "level": 4,
    "task": 7,
    "opcode": 36,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:20:52.991+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{E6DA7C55-BDD5-43E2-923E-C2831F5534D0}"
    },
    "execution": {
      "process_id": 3756,
      "thread_id": 4400
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Classification": 1,
    "EventType": 31,
    "FileID": 174812,
    "FileName": "C:\\Users\\localuser\\AppData\\Local\\Temp\\__PSScriptPolicyTest_i3yqwsnl.1tp.ps1",
    "FileUSN": 153465104,
    "Info": "",
    "Result": "00000000",
    "ScanSource": 0
  },
  "message": "CacheTask"
}

Event ID 38: Cache

Channel: Application
Also via: realtime ETW trace
Level: Informational
Task: Cache
Opcode: CacheLookup

Fields #

Name	Description
`FileName` UnicodeString
`CacheName` UnicodeString
`Result` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Antimalware-Engine",
    "guid": "{0A002690-3839-4E3A-B3B6-96D8DF868D99}",
    "event_source_name": "",
    "event_id": 38,
    "version": 0,
    "level": 4,
    "task": 7,
    "opcode": 38,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:20:53.151+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3756,
      "thread_id": 13108
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "CacheName": "USN Cache",
    "FileName": "C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\fabb9e10f6808e7fbef2496dc4f4b9a2\\Microsoft.WSMan.Management.ni.dll",
    "Result": "MISS"
  },
  "message": "CacheTask"
}

Event ID 39: Cache

Channel: Application
Task: Cache
Opcode: CacheAdd

Fields #

Name	Description
`FileName` UnicodeString
`CacheName` UnicodeString
`Result` UnicodeString

Event ID 40: PersistedStoreTaskPersistedStoreAction

Channel: Application
Task: PersistedStoreTask
Opcode: PersistedStoreAction

Fields #

Name	Description
`action` UnicodeString
`key` UInt64
`filename` UnicodeString
`result` UInt32

Event ID 41: PersistedStoreTaskPersistedStoreMaintenance

Channel: Application
Task: PersistedStoreTask
Opcode: PersistedStoreMaintenance

Fields #

Name	Description
`utilization` UInt32
`result` UInt32

Event ID 42: PersistedStoreTaskPersistedStoreAnalyzeFile

Channel: Application
Task: PersistedStoreTask
Opcode: PersistedStoreAnalyzeFile

Fields #

Name	Description
`key` UInt64
`filename` UnicodeString
`parentKey` UInt64
`result` UInt32

Event ID 43: ExpensiveOperationTask

Channel: Application
Also via: realtime ETW trace
Level: Informational
Task: ExpensiveOperationTask
Opcode: ExpensiveOperationBegin

Fields #

Name	Description
`Message` UnicodeString
`Name` UnicodeString
`Data` UInt64
`StartStop` Boolean
`ThreadTime` FILETIME

Example Event #

{
  "system": {
    "provider": "Microsoft-Antimalware-Engine",
    "guid": "{0A002690-3839-4E3A-B3B6-96D8DF868D99}",
    "event_source_name": "",
    "event_id": 43,
    "version": 1,
    "level": 4,
    "task": 9,
    "opcode": 43,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:20:52.990+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{E6DA7C55-BDD5-43E2-923E-C2831F5534D0}"
    },
    "execution": {
      "process_id": 3756,
      "thread_id": 4400
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": 60,
    "Message": "GetHashes",
    "Name": "\\Device\\HarddiskVolume4\\Users\\localuser\\AppData\\Local\\Temp\\__PSScriptPolicyTest_i3yqwsnl.1tp.ps1",
    "StartStop": true,
    "ThreadTime": "1601-01-01 00:01:27.187Z"
  },
  "message": "ExpensiveOperationTask"
}

Event ID 44: MetaStoreTask

Channel: Application
Also via: realtime ETW trace
Level: Informational
Task: MetaStoreTask
Opcode: MetaStoreAction

Fields #

Name	Description
`action` UnicodeString
`vault` UInt32
`key` UInt64
`result` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Antimalware-Engine",
    "guid": "{0A002690-3839-4E3A-B3B6-96D8DF868D99}",
    "event_source_name": "",
    "event_id": 44,
    "version": 0,
    "level": 4,
    "task": 10,
    "opcode": 44,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:20:52.921+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3756,
      "thread_id": 1744
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "action": "exists",
    "key": 1312170257355239075,
    "result": 0,
    "vault": 7
  },
  "message": "MetaStoreTask"
}

Event ID 45: MetaStoreTaskMetaStoreMaintenance

Channel: Application
Task: MetaStoreTask
Opcode: MetaStoreMaintenance

Fields #

Name	Description
`vault` UInt32
`records` UInt64
`result` UInt32

Event ID 46: Behavior Monitoring

Channel: Application
Task: BehaviorMonitoring
Opcode: BmRegistryBlockSet

Fields #

Name	Description
`PID` UInt32
`KeyPath` UnicodeString

Event ID 47: Behavior Monitoring

Channel: Application
Task: BehaviorMonitoring
Opcode: BmRegistryBlockDelete

Fields #

Name	Description
`PID` UInt32
`KeyPath` UnicodeString

Event ID 48: Behavior Monitoring

Channel: Application
Task: BehaviorMonitoring
Opcode: BmRegistryBlockRename

Fields #

Name	Description
`PID` UInt32
`KeyPath` UnicodeString

Event ID 49: Behavior Monitoring

Channel: Application
Task: BehaviorMonitoring
Opcode: BmRegistryReplace

Fields #

Name	Description
`PID` UInt32
`KeyPath` UnicodeString

Event ID 50: Behavior Monitoring

Channel: Application
Task: BehaviorMonitoring
Opcode: BmRegistryRestore

Fields #

Name	Description
`PID` UInt32
`KeyPath` UnicodeString

Event ID 51: Behavior Monitoring

Channel: Application
Task: BehaviorMonitoring
Opcode: BmRegistryBlockReplace

Fields #

Name	Description
`PID` UInt32
`KeyPath` UnicodeString

Event ID 52: Behavior Monitoring

Channel: Application
Task: BehaviorMonitoring
Opcode: BmRegistryBlockRestore

Fields #

Name	Description
`PID` UInt32
`KeyPath` UnicodeString

Event ID 53: Behavior Monitoring

Channel: Application
Also via: realtime ETW trace
Level: Informational
Task: BehaviorMonitoring
Opcode: BmOpenProcess

Fields #

Name	Description
`PID` UInt32
`TargetPID` UInt32
`AccessMask` UInt32	Access mask reference
`WasHardened` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Antimalware-Engine",
    "guid": "{0A002690-3839-4E3A-B3B6-96D8DF868D99}",
    "event_source_name": "",
    "event_id": 53,
    "version": 0,
    "level": 4,
    "task": 6,
    "opcode": 53,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:20:52.947+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3756,
      "thread_id": 8752
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AccessMask": 2097151,
    "PID": 15704,
    "TargetPID": 14692,
    "WasHardened": false
  },
  "message": "BehaviorMonitorTask"
}

Event ID 58: Behavior Monitoring

Channel: Application
Task: BehaviorMonitoring
Opcode: BmRegistryBlockCreate

Fields #

Name	Description
`PID` UInt32
`KeyPath` UnicodeString

Event ID 59: Message

Channel: Application
Also via: realtime ETW trace
Level: Informational
Task: Message
Opcode: win:Info

Fields #

Name	Description
`VName` AnsiString
`SigSeq` HexInt64
`SigSha` AnsiString
`Result` Int8

Example Event #

{
  "system": {
    "provider": "Microsoft-Antimalware-Engine",
    "guid": "{0A002690-3839-4E3A-B3B6-96D8DF868D99}",
    "event_source_name": "",
    "event_id": 59,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:20:53.030+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3756,
      "thread_id": 1744
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Result": 0,
    "SigSeq": "E24B7913B31F0100",
    "SigSha": "4b623fca87b0cb1048a094ee73e570d3e5ba1f97",
    "VName": "Behavior:Win32/NonStdMpClientLoader.A"
  },
  "message": "GenericMessageTask"
}

Event ID 60: Behavior Monitoring

Channel: Application
Also via: realtime ETW trace
Level: Informational
Task: BehaviorMonitoring
Opcode: BmEtw

Fields #

Name	Description
`PID` UInt32
`Channel` UnicodeString
`EventId` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Antimalware-Engine",
    "guid": "{0A002690-3839-4E3A-B3B6-96D8DF868D99}",
    "event_source_name": "",
    "event_id": 60,
    "version": 0,
    "level": 4,
    "task": 6,
    "opcode": 60,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:20:53.214+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3756,
      "thread_id": 1748
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Channel": "ThreatIntel",
    "EventId": 19,
    "PID": 16720
  },
  "message": "BehaviorMonitorTask"
}

Event ID 61: Behavior Monitoring

Channel: Application
Also via: realtime ETW trace
Level: Informational
Task: BehaviorMonitoring
Opcode: BmFolderCreate

Fields #

Name	Description
`PID` UInt32
`FolderName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Antimalware-Engine",
    "guid": "{0A002690-3839-4E3A-B3B6-96D8DF868D99}",
    "event_source_name": "",
    "event_id": 61,
    "version": 0,
    "level": 4,
    "task": 6,
    "opcode": 61,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:20:53.109+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3756,
      "thread_id": 8752
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "FolderName": "\\Device\\HarddiskVolume4\\Users\\localuser\\AppData\\Local\\Temp\\EtwGenFile_09220244\\subdir",
    "PID": 15144
  },
  "message": "BehaviorMonitorTask"
}

Event ID 62: Behavior Monitoring

Channel: Application
Also via: realtime ETW trace
Level: Informational
Task: BehaviorMonitoring
Opcode: BmScavengerTask

Fields #

Name	Description
`Count` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Antimalware-Engine",
    "guid": "{0A002690-3839-4E3A-B3B6-96D8DF868D99}",
    "event_source_name": "",
    "event_id": 62,
    "version": 0,
    "level": 4,
    "task": 6,
    "opcode": 62,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:20:53.261+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3756,
      "thread_id": 15096
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Count": 1
  },
  "message": "BehaviorMonitorTask"
}

Event ID 63: Behavior Monitoring

Channel: Application
Level: Informational
Task: BehaviorMonitoring
Opcode: BmProcessTainting

Fields #

Name	Description
`TaintReason` UInt64
`ReasonImagePath` UnicodeString
`ProcessImagePath` UnicodeString

Example Event #

{
  "system": {
    "channel": "Application",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 63,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 11592
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 63,
    "provider": "Microsoft-Antimalware-Engine",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:13:24.259Z",
    "version": 0
  },
  "event_data": {
    "ProcessImagePath": "C:\\PPLRunner\\sealighter.exe",
    "ReasonImagePath": "C:\\Tools\\RPCFW_2.2.5\\rpcFwManager.exe",
    "TaintReason": 2
  },
  "message": ""
}

Event ID 64: Behavior Monitoring

Channel: Application
Task: BehaviorMonitoring
Opcode: BmFolderRename

Fields #

Name	Description
`PID` UInt32
`FileName` UnicodeString
`OldFileName` UnicodeString

Event ID 65: Behavior Monitoring

Channel: Application
Task: BehaviorMonitoring
Opcode: BmFolderEnum

Fields #

Name	Description
`PID` UInt32
`FolderName` UnicodeString

Event ID 66: Behavior Monitoring

Channel: Application
Task: BehaviorMonitoring
Opcode: BmFileHardLink

Fields #

Name	Description
`PID` UInt32
`FileName` UnicodeString
`FileHardLinkName` UnicodeString

Event ID 67: ExpensiveOperationTask

Channel: Application
Also via: realtime ETW trace
Level: Informational
Task: ExpensiveOperationTask
Opcode: ExpensiveOperationEnd

Fields #

Name	Description
`Message` UnicodeString
`Name` UnicodeString
`Data` UInt64
`StartStop` Boolean
`ThreadTime` FILETIME
`DeltaCPU` UInt64
`DeltaWall` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Antimalware-Engine",
    "guid": "{0A002690-3839-4E3A-B3B6-96D8DF868D99}",
    "event_source_name": "",
    "event_id": 67,
    "version": 1,
    "level": 4,
    "task": 9,
    "opcode": 67,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:20:52.990+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{E6DA7C55-BDD5-43E2-923E-C2831F5534D0}"
    },
    "execution": {
      "process_id": 3756,
      "thread_id": 4400
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": 60,
    "DeltaCPU": 0,
    "DeltaWall": 0,
    "Message": "GetHashes",
    "Name": "\\Device\\HarddiskVolume4\\Users\\localuser\\AppData\\Local\\Temp\\__PSScriptPolicyTest_i3yqwsnl.1tp.ps1",
    "StartStop": false,
    "ThreadTime": "1601-01-01 00:01:27.187Z"
  },
  "message": "ExpensiveOperationTask"
}

Event ID 68: Message

Channel: Application
Task: Message

Fields #

Name	Description
`SigName` AnsiString
`SigSeq` HexInt64
`SigSha` AnsiString
`SigTypeName` AnsiString
`Dimension` AnsiString
`Value` UInt64
`Limit` UInt64
`FileName` UnicodeString
`VPath` UnicodeString
`FileSha1` AnsiString
`PartialCRC1` HexInt32
`PartialCRC2` HexInt32
`PartialCRC3` HexInt32
`FileSize` UInt64

Event ID 69: Message

Channel: Application
Task: Message

Fields #

Name	Description
`Guid` AnsiString
`VolumeSize` UInt64
`Attributes` HexInt32
`FilesCount` HexInt32
`FileGuidsArray` AnsiString
`FileSizeArray` AnsiString
`CompressedFileSizeArray` AnsiString
`FileNameArray` UnicodeString
`FileAttributesArray` AnsiString
`EfiFileTypeArray` AnsiString
`FileSha1Array` AnsiString
`SmbiosAttributes` AnsiString
`FileCRCsArray` AnsiString

Event ID 70: Behavior Monitoring

Channel: Application
Also via: realtime ETW trace
Level: Informational
Task: BehaviorMonitoring
Opcode: BmProcessCreate

Fields #

Name	Description
`BasePath` UnicodeString
`CommandLine` UnicodeString
`PID` UInt32
`ParentPID` UInt32
`Flags` UInt32
`IntegrityLevel` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Antimalware-Engine",
    "guid": "{0A002690-3839-4E3A-B3B6-96D8DF868D99}",
    "event_source_name": "",
    "event_id": 70,
    "version": 0,
    "level": 4,
    "task": 6,
    "opcode": 68,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T04:10:16.967+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3756,
      "thread_id": 10388
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "BasePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\logman.exe",
    "CommandLine": "\"C:\\WINDOWS\\system32\\logman.exe\" query etw-cap-fixtest-b0 -ets",
    "Flags": 33554432,
    "IntegrityLevel": 12288,
    "PID": 4944,
    "ParentPID": 2348
  },
  "message": "BehaviorMonitorTask"
}

Event ID 71: Behavior Monitoring

Channel: Application
Also via: realtime ETW trace
Level: Informational
Task: BehaviorMonitoring
Opcode: BmFileCreateEx

Fields #

Name	Description
`PID` UInt32
`FileName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Antimalware-Engine",
    "guid": "{0A002690-3839-4E3A-B3B6-96D8DF868D99}",
    "event_source_name": "",
    "event_id": 71,
    "version": 0,
    "level": 4,
    "task": 6,
    "opcode": 69,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:20:52.948+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3756,
      "thread_id": 8752
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "FileName": "\\Device\\HarddiskVolume4\\Users\\localuser\\AppData\\Local\\Temp\\EtwGen_8ddae864\\host.err",
    "PID": 15704
  },
  "message": "BehaviorMonitorTask"
}

Event ID 72: Behavior Monitoring

Channel: Application
Also via: realtime ETW trace
Level: Informational
Task: BehaviorMonitoring
Opcode: BmFileChangeEx

Fields #

Name	Description
`PID` UInt32
`FileName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Antimalware-Engine",
    "guid": "{0A002690-3839-4E3A-B3B6-96D8DF868D99}",
    "event_source_name": "",
    "event_id": 72,
    "version": 0,
    "level": 4,
    "task": 6,
    "opcode": 70,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:20:53.210+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3756,
      "thread_id": 8752
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "FileName": "\\Device\\HarddiskVolume4\\Users\\localuser\\AppData\\Local\\Temp\\__PSScriptPolicyTest_sbsid2qt.goq.psm1",
    "PID": 11280
  },
  "message": "BehaviorMonitorTask"
}

Event ID 73: Behavior Monitoring

Channel: Application
Also via: realtime ETW trace
Level: Informational
Task: BehaviorMonitoring
Opcode: ProcessMonitorFlags

Fields #

Name	Description
`EngineId` Pointer
`CreationTime` FILETIME
`PID` UInt32
`filepath` UnicodeString
`flags` HexInt32
`flags2low` HexInt64
`flags2high` HexInt64
`oldFlags` HexInt32
`oldFlags2low` HexInt64
`oldFlags2high` HexInt64
`Source` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Antimalware-Engine",
    "guid": "{0A002690-3839-4E3A-B3B6-96D8DF868D99}",
    "event_source_name": "",
    "event_id": 73,
    "version": 2,
    "level": 4,
    "task": 6,
    "opcode": 71,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:20:53.161+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{F2714F70-C68A-4E47-85BF-FAD7C1934515}"
    },
    "execution": {
      "process_id": 3756,
      "thread_id": 4400
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "CreationTime": "2026-06-02 05:20:53.156Z",
    "EngineId": "0x7FFCAC8D0000",
    "PID": 5984,
    "Source": "SyncStart",
    "filepath": "C:\\Windows\\System32\\logman.exe",
    "flags": "FF030040",
    "flags2high": "0000000000000000",
    "flags2low": "4400000000000000",
    "oldFlags": "00000000",
    "oldFlags2high": "0000000000000000",
    "oldFlags2low": "0000000000000000"
  },
  "message": "BehaviorMonitorTask"
}

Event ID 74: SenseRemediationTask

Channel: Application
Task: SenseRemediationTask

Fields #

Name	Description
`Sha1` UnicodeString
`Sha256` UnicodeString
`SigSeq` HexInt64
`SigSha` UnicodeString
`AllSigSeqs` UnicodeString
`AllSigShas` UnicodeString
`RealPath` UnicodeString
`VPath` UnicodeString
`EtwDataReportType` UInt32
`ReportType` UInt32
`EngineReportGuid` UnicodeString
`ResourceData` UnicodeString
`ResourceSchema` UnicodeString
`Determination` Int32
`ActionStatus` HexInt32
`ProcessID` UInt32
`ProcessCreationTime` UInt64
`ProcessPath` UnicodeString
`ThreatName` UnicodeString
`Classification` HexInt32
`IsLatent` Boolean
`IsPassiveMode` Boolean
`ScanSource` UInt32
`ScanType` UInt32
`RtpProcessID` UInt32
`RtpProcessCreationTime` UInt64
`ProcessCommandLine` UnicodeString
`ExtraDataJson` UnicodeString

Event ID 75: Message

Channel: Application
Task: Message

Fields #

Name	Description
`DeviceInfo` AnsiString
`TCGEventsArray` AnsiString
`PCRsArray` AnsiString

Event ID 76: SenseHeartbeatTask

Channel: Application
Level: Informational
Task: SenseHeartbeatTask

Fields #

Name	Description
`JsonData` UnicodeString

Example Event #

{
  "system": {
    "channel": "Application",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 76,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 11336
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Antimalware-Engine",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:14:36.194Z",
    "version": 0
  },
  "event_data": {
    "JsonData": {
      "HeartbeatType": 11,
      "EngineReportGuid": "E68DECE9-E53B-4E1C-BC66-C18B44651B7F",
      "EngineVersion": "1.1.26060.3008",
      "AppVersion": "4.18.26060.3008",
      "EngineRing": 5,
      "CampRing": 5,
      "SignatureRing": 5,
      "OfficeConfigurationValue": 4294967295,
      "AvSigVersion": "1.455.263.0",
      "SignatureUpdateTime": 134291706121003613,
      "LastMAPSSuccessTime": 134291816738095878,
      "LastMAPSFailureTime": 134255523670769200,
      "RealTimeProtection": "",
      "OnAccessProtection": "",
      "GeoId": 0,
      "AutoSampleSubmissionOptInValue": 0,
      "BlockAtFirstSight": true,
      "NetworkProtectionState": "1",
      "IsPassiveMode": false,
      "IsSxSPassiveMode": false,
      "SmartScreenAppRep": "",
      "SmartScreenEdgeUrlRep": "",
      "EdgeBloomFilterTime": 0,
      "AnaheimBloomFilterTime": 0,
      "NetworkProtectionBloomFilterTime": 639203016552166006,
      "AmsiEnabled": 1,
      "SenseDLPEnabled": 0,
      "PassiveRemediation": 0,
      "IoavEnabled": 1,
      "SignatureFallbackOrder": "MicrosoftUpdateServer|MMPC",
      "CurrentThreatInfo": "ThreatCount=0",
      "LastFullScanResult": "ThreatCount=9",
      "LastFullScanEndTime": 134179142902914438,
      "LastFullScanDuration": 5246290487,
      "LastQuickScanResult": "ThreatCount=0",
      "LastQuickScanEndTime": 134291812136016552,
      "LastQuickScanDuration": 18464383465,
      "IsSignatureUpToDate": true,
      "AVSignatureDue": 7,
      "AVSignatureBuildTime": 134291483220000000,
      "LatestPlatformReleaseTime": 134278434528625645,
      "LatestPlatformVersion": "4.18.26060.3008",
      "IsPlatformUpToDate": true,
      "LatestEngineReleaseTime": 134278376540703200,
      "LatestEngineVersion": "1.1.26060.3008",
      "IsEngineUpToDate": true
    }
  },
  "message": ""
}

Event ID 77: SmsScanTaskSmsRequestMonitorProcessId

Channel: Application
Level: Informational
Task: SmsScanTask
Opcode: SmsRequestMonitorProcessId

Fields #

Name	Description
`ProcessId` UInt32
`CreationTime` FILETIME
`Level` UInt8
`EffectiveLevel` UInt8
`TriggerSigSeq` UInt64
`Origin` UInt8

Example Event #

{
  "system": {
    "channel": "Application",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 77,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 12528
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 72,
    "provider": "Microsoft-Antimalware-Engine",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:13:28.866Z",
    "version": 0
  },
  "event_data": {
    "CreationTime": "2026-07-22 08:13:19.386Z",
    "EffectiveLevel": 5,
    "Level": 5,
    "Origin": 1,
    "ProcessId": 11596,
    "TriggerSigSeq": 210778827871879
  },
  "message": ""
}

Event ID 78: SmsScanTaskSmsRequestMonitorFilePath

Channel: Application
Task: SmsScanTask
Opcode: SmsRequestMonitorFilePath

Fields #

Name	Description
`ImageFilePath` UnicodeString
`Level` UInt8
`EffectiveLevel` UInt8
`TriggerSigSeq` UInt64
`Origin` UInt8

Event ID 79: SmsScanTaskSmsMonitoringStart

Channel: Application
Level: Informational
Task: SmsScanTask
Opcode: SmsMonitoringStart

Fields #

Name	Description
`ProcessId` UInt32
`CreationTime` FILETIME
`Level` UInt8
`TriggerSigSeq` UInt64

Example Event #

{
  "system": {
    "channel": "Application",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 79,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 3536
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 74,
    "provider": "Microsoft-Antimalware-Engine",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:13:26.556Z",
    "version": 0
  },
  "event_data": {
    "CreationTime": "2026-07-22 08:13:19.386Z",
    "Level": 5,
    "ProcessId": 11596,
    "TriggerSigSeq": 210778827871879
  },
  "message": ""
}

Event ID 80: SmsScanTaskSmsMonitoringStop

Channel: Application
Task: SmsScanTask
Opcode: SmsMonitoringStop

Fields #

Name	Description
`ProcessId` UInt32
`CreationTime` FILETIME
`Level` UInt8
`TriggerSigSeq` UInt64
`StopReason` UInt8

Event ID 81: SmsScanTaskSmsScanStart

Channel: Application
Level: Informational
Task: SmsScanTask
Opcode: SmsScanStart

Fields #

Name	Description
`ProcessId` UInt32
`CreationTime` FILETIME
`ScanReason` UInt8

Example Event #

{
  "system": {
    "channel": "Application",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 81,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 3536
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 76,
    "provider": "Microsoft-Antimalware-Engine",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:13:26.556Z",
    "version": 0
  },
  "event_data": {
    "CreationTime": "2026-07-22 08:13:19.386Z",
    "ProcessId": 11596,
    "ScanReason": 4
  },
  "message": ""
}

Event ID 82: SmsScanTaskSmsScanStop

Channel: Application
Level: Informational
Task: SmsScanTask
Opcode: SmsScanStop

Fields #

Name	Description
`ProcessId` UInt32
`CreationTime` FILETIME
`ScanReason` UInt8
`ScanResult` UInt8

Example Event #

{
  "system": {
    "channel": "Application",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 82,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 3536
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 77,
    "provider": "Microsoft-Antimalware-Engine",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:13:28.813Z",
    "version": 0
  },
  "event_data": {
    "CreationTime": "2026-07-22 08:13:19.386Z",
    "ProcessId": 11596,
    "ScanReason": 4,
    "ScanResult": 1
  },
  "message": ""
}

Event ID 83: StartRundownTaskStart

Channel: Application
Task: StartRundownTask
Opcode: Start

Fields #

Name	Description
`EngineId` Pointer

Event ID 84: StartRundownTaskStop

Channel: Application
Task: StartRundownTask
Opcode: Stop

Fields #

Name	Description
`EngineId` Pointer

Event ID 85: EndRundownTaskStart

Channel: Application
Task: EndRundownTask
Opcode: Start

Fields #

Name	Description
`EngineId` Pointer

Event ID 86: EndRundownTaskStop

Channel: Application
Task: EndRundownTask
Opcode: Stop

Fields #

Name	Description
`EngineId` Pointer

Event ID 87: EngineTaskStart

Channel: Application
Task: EngineTask
Opcode: Start

Fields #

Name	Description
`EngineId` Pointer
`EngineVersion` UnicodeString
`AVVersion` UnicodeString
`ASVersion` UnicodeString

Event ID 88: EngineTaskStop

Channel: Application
Task: EngineTask
Opcode: Stop

Fields #

Name	Description
`EngineId` Pointer
`EngineVersion` UnicodeString
`AVVersion` UnicodeString
`ASVersion` UnicodeString

Event ID 89: EngineTaskDCStart

Channel: Application
Task: EngineTask
Opcode: DC_Start

Fields #

Name	Description
`EngineId` Pointer
`EngineVersion` UnicodeString
`AVVersion` UnicodeString
`ASVersion` UnicodeString

Event ID 90: EngineTaskDCStop

Channel: Application
Task: EngineTask
Opcode: DC_Stop

Fields #

Name	Description
`EngineId` Pointer
`EngineVersion` UnicodeString
`AVVersion` UnicodeString
`ASVersion` UnicodeString

Event ID 91: UfsScanFileTaskDCStart_V1

Channel: Application
Task: UfsScanFileTask
Opcode: DC_Start

Fields #

Name	Description
`EngineId` Pointer
`FilePath` UnicodeString
`ThreadId` UInt32
`StartQPC` UInt64

Event ID 92: UfsScanFileTaskDCStop_V1

Channel: Application
Task: UfsScanFileTask
Opcode: DC_Stop

Fields #

Name	Description
`EngineId` Pointer
`FilePath` UnicodeString
`ThreadId` UInt32
`StartQPC` UInt64

Event ID 93: UfsScanProcTaskDCStart_V1

Channel: Application
Task: UfsScanProcTask
Opcode: DC_Start

Fields #

Name	Description
`EngineId` Pointer
`FilePath` UnicodeString
`PID` UInt32
`ThreadId` UInt32
`StartQPC` UInt64

Event ID 94: UfsScanProcTaskDCStop_V1

Channel: Application
Task: UfsScanProcTask
Opcode: DC_Stop

Fields #

Name	Description
`EngineId` Pointer
`FilePath` UnicodeString
`PID` UInt32
`ThreadId` UInt32
`StartQPC` UInt64

Event ID 95: Behavior Monitoring

Channel: Application
Also via: realtime ETW trace
Level: Informational
Task: BehaviorMonitoring
Opcode: BmFileOverwrite

Fields #

Name	Description
`ProcessId` UInt32
`CreationTime` FILETIME
`FileName` UnicodeString
`FirstOffsetWritten` UInt64
`LastOffsetWritten` UInt64
`SmallestOffsetWritten` UInt64
`BiggestOffsetWritten` UInt64
`TotalSizeOfWrites` UInt64
`TotalSizeOfAppends` UInt64
`NumberOfWrites` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Antimalware-Engine",
    "guid": "{0A002690-3839-4E3A-B3B6-96D8DF868D99}",
    "event_source_name": "",
    "event_id": 95,
    "version": 0,
    "level": 4,
    "task": 6,
    "opcode": 78,
    "keywords": "0x0000000000000010",
    "time_created": "2026-06-02T04:10:43.003+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3756,
      "thread_id": 10144
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "BiggestOffsetWritten": 104044,
    "CreationTime": "2026-05-27 20:01:10.073Z",
    "FileName": "\\Device\\HarddiskVolume4\\Users\\localuser\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper",
    "FirstOffsetWritten": 0,
    "LastOffsetWritten": 104044,
    "NumberOfWrites": 13,
    "ProcessId": 5396,
    "SmallestOffsetWritten": 0,
    "TotalSizeOfAppends": 0,
    "TotalSizeOfWrites": 104053
  },
  "message": "BehaviorMonitorTask"
}

Event ID 96: SenseOnboardingInfoTask

Channel: Application
Task: SenseOnboardingInfoTask

Fields #

Name	Description
`OnboardedInfo` UnicodeString

Event ID 97: Scan request

Channel: Application
Task: Scanrequest
Opcode: DC_Start

Fields #

Name	Description
`EngineId` Pointer
`Id` UInt8
`Type` AnsiString
`Flags` HexInt32
`ScanSource` UInt32
`ResourceCount` UInt32
`FirstResourceType` UnicodeString
`FirstResourcePath` UnicodeString
`ThreadId` UInt32
`StartQPC` UInt64

Event ID 98: Scan request

Channel: Application
Task: Scanrequest
Opcode: DC_Stop

Fields #

Name	Description
`EngineId` Pointer
`Id` UInt8
`Type` AnsiString
`Flags` HexInt32
`ScanSource` UInt32
`ResourceCount` UInt32
`FirstResourceType` UnicodeString
`FirstResourcePath` UnicodeString
`ThreadId` UInt32
`StartQPC` UInt64

Event ID 99: Behavior Monitoring

Channel: Application
Task: BehaviorMonitoring
Opcode: ProcessMonitorFlagsDCStart

Fields #

Name	Description
`EngineId` Pointer
`CreationTime` FILETIME
`PID` UInt32
`flags` HexInt32
`flags2low` HexInt64
`flags2high` HexInt64

Event ID 100: Behavior Monitoring

Channel: Application
Task: BehaviorMonitoring
Opcode: ProcessMonitorFlagsDCStop

Fields #

Name	Description
`EngineId` Pointer
`CreationTime` FILETIME
`PID` UInt32
`flags` HexInt32
`flags2low` HexInt64
`flags2high` HexInt64

Event ID 101: EngineLoadTaskStart

Channel: Application
Task: EngineLoadTask
Opcode: Start

Fields #

Name	Description
`EngineId` Pointer
`EngineVersion` UnicodeString
`AVVersion` UnicodeString
`ASVersion` UnicodeString

Event ID 102: EngineLoadTaskStop

Channel: Application
Task: EngineLoadTask
Opcode: Stop

Fields #

Name	Description
`EngineId` Pointer
`EngineVersion` UnicodeString
`AVVersion` UnicodeString
`ASVersion` UnicodeString

Event ID 103: Behavior Monitoring

Channel: Application
Task: BehaviorMonitoring
Opcode: BmFileSequentialRead

Fields #

Name	Description
`PID` UInt32
`FileName` UnicodeString

Event ID 104: Behavior Monitoring

Channel: Application
Also via: realtime ETW trace
Level: Informational
Task: BehaviorMonitoring
Opcode: BmInternal

Fields #

Name	Description
`PID` UInt32
`FeatureId` UInt32
`FirstParam` UnicodeString
`SecondParam` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Antimalware-Engine",
    "guid": "{0A002690-3839-4E3A-B3B6-96D8DF868D99}",
    "event_source_name": "",
    "event_id": 104,
    "version": 0,
    "level": 4,
    "task": 6,
    "opcode": 82,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:20:52.968+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3756,
      "thread_id": 1744
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "FeatureId": 22,
    "FirstParam": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
    "PID": 13856,
    "SecondParam": "\"C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\\Tools\\Sealighter\\drv\\drv15.ps1 "
  },
  "message": "BehaviorMonitorTask"
}

Event ID 105: Behavior Monitoring

Channel: Application
Also via: realtime ETW trace
Level: Informational
Task: BehaviorMonitoring
Opcode: BmRegistry

Fields #

Name	Description
`PID` UInt32
`EventId` UnicodeString
`KeyPath` UnicodeString
`ValueName` UnicodeString
`OldValue` UnicodeString
`NewValue` UnicodeString
`UserMode` UnicodeString
`FeatureType` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Antimalware-Engine",
    "guid": "{0A002690-3839-4E3A-B3B6-96D8DF868D99}",
    "event_source_name": "",
    "event_id": 105,
    "version": 0,
    "level": 4,
    "task": 6,
    "opcode": 83,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:20:52.967+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3756,
      "thread_id": 6200
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "EventId": "RegistryValueSet",
    "FeatureType": 0,
    "KeyPath": "HKCU@S-1-5-21-3798294047-1846905762-1150995898-1000\\SOFTWARE\\ETWGEN",
    "NewValue": "2026-06-02T05:20:23.7274078+00:00",
    "OldValue": "N/A",
    "PID": 6556,
    "UserMode": "false",
    "ValueName": "ts"
  },
  "message": "BehaviorMonitorTask"
}

Event ID 106: Behavior Monitoring

Channel: Application
Task: BehaviorMonitoring
Opcode: BmInternalStateDCStart

Fields #

Name	Description
`EngineId` Pointer
`LiveContextCount` UInt32
`TotalContextCount` UInt32

Event ID 107: Behavior Monitoring

Channel: Application
Task: BehaviorMonitoring
Opcode: BmInternalStateDCStop

Fields #

Name	Description
`EngineId` Pointer
`LiveContextCount` UInt32
`TotalContextCount` UInt32

Event ID 108: SenseExclusionTask

Channel: Application
Task: SenseExclusionTask

Fields #

Name	Description
`Type` AnsiString
`Scope` AnsiString
`ResourceType` AnsiString
`TargetResource` UnicodeString
`ParentResource` UnicodeString
`DetectionName` AnsiString
`UserName` UnicodeString

Event ID 109: Behavior Monitoring

Channel: Application
Also via: realtime ETW trace
Level: Informational
Task: BehaviorMonitoring
Opcode: BmProcessContextStart

Fields #

Name	Description
`PID` UInt32
`ProcessContextId` Pointer
`ImagePath` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Antimalware-Engine",
    "guid": "{0A002690-3839-4E3A-B3B6-96D8DF868D99}",
    "event_source_name": "",
    "event_id": 109,
    "version": 0,
    "level": 4,
    "task": 6,
    "opcode": 86,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T04:10:16.967+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3756,
      "thread_id": 10388
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ImagePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\logman.exe",
    "PID": 4944,
    "ProcessContextId": "0x1FF1D6EFEE0"
  },
  "message": "BehaviorMonitorTask"
}

Event ID 110: Behavior Monitoring

Channel: Application
Also via: realtime ETW trace
Level: Informational
Task: BehaviorMonitoring
Opcode: BmProcessContextStop

Fields #

Name	Description
`PID` UInt32
`ProcessContextId` Pointer
`TerminationTime` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Antimalware-Engine",
    "guid": "{0A002690-3839-4E3A-B3B6-96D8DF868D99}",
    "event_source_name": "",
    "event_id": 110,
    "version": 0,
    "level": 4,
    "task": 6,
    "opcode": 87,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T04:10:40.283+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3756,
      "thread_id": 2760
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "PID": 1220,
    "ProcessContextId": "0x1FF1FD2AEE0",
    "TerminationTime": 134248470076227719
  },
  "message": "BehaviorMonitorTask"
}

Event ID 111: Behavior Monitoring

Channel: Application
Also via: realtime ETW trace
Level: Informational
Task: BehaviorMonitoring
Opcode: BmNotificationHandleStart

Fields #

Name	Description
`PID` UInt32
`AttrId` UInt32
`AttrSeq` UInt32
`AttrSubset` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Antimalware-Engine",
    "guid": "{0A002690-3839-4E3A-B3B6-96D8DF868D99}",
    "event_source_name": "",
    "event_id": 111,
    "version": 0,
    "level": 4,
    "task": 6,
    "opcode": 88,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:20:52.921+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3756,
      "thread_id": 1744
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AttrId": 16404,
    "AttrSeq": 1812357,
    "AttrSubset": 0,
    "PID": 13856
  },
  "message": "BehaviorMonitorTask"
}

Event ID 112: Behavior Monitoring

Channel: Application
Also via: realtime ETW trace
Level: Informational
Task: BehaviorMonitoring
Opcode: BmNotificationHandleStop

Fields #

Name	Description
`PID` UInt32
`AttrId` UInt32
`AttrSeq` UInt32
`AttrSubset` UInt32
`MatchedThreatsNumber` UInt32
`IsMultiProcMatch` Boolean
`IsMultiProcDetection` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Antimalware-Engine",
    "guid": "{0A002690-3839-4E3A-B3B6-96D8DF868D99}",
    "event_source_name": "",
    "event_id": 112,
    "version": 0,
    "level": 4,
    "task": 6,
    "opcode": 89,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:20:52.921+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3756,
      "thread_id": 1744
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AttrId": 16404,
    "AttrSeq": 1812357,
    "AttrSubset": 0,
    "IsMultiProcDetection": false,
    "IsMultiProcMatch": false,
    "MatchedThreatsNumber": 0,
    "PID": 13856
  },
  "message": "BehaviorMonitorTask"
}

Event ID 113: Behavior Monitoring

Channel: Application
Level: Informational
Task: BehaviorMonitoring
Opcode: BmCloudCallStart

Fields #

Name	Description
`PID` UInt32
`DetectionName` UnicodeString
`SigSeq` UInt64

Example Event #

{
  "system": {
    "channel": "Application",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 113,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 6908
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 90,
    "provider": "Microsoft-Antimalware-Engine",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:14:27.813Z",
    "version": 0
  },
  "event_data": {
    "DetectionName": "Behavior:Win32/RemoteInvocationDetection.A",
    "PID": 9776,
    "SigSeq": 157999147879664
  },
  "message": ""
}

Event ID 114: Behavior Monitoring

Channel: Application
Level: Informational
Task: BehaviorMonitoring
Opcode: BmCloudCallStop

Fields #

Name	Description
`PID` UInt32
`DetectionName` UnicodeString
`SigSeq` UInt64
`CloudResponse` UnicodeString

Example Event #

{
  "system": {
    "channel": "Application",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 114,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 6908
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 91,
    "provider": "Microsoft-Antimalware-Engine",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:14:28.175Z",
    "version": 0
  },
  "event_data": {
    "CloudResponse": "N/A",
    "DetectionName": "Behavior:Win32/RemoteInvocationDetection.A",
    "PID": 9776,
    "SigSeq": 157999147879664
  },
  "message": ""
}

Event ID 115: BehaviorMonitoringBmDbChanged

Channel: Application
Task: BehaviorMonitorTask
Opcode: BmDbChanged

Fields #

Name	Description
`PID` UInt32
`FileName` UnicodeString

Provenance

ETW provider GUID {0A002690-3839-4E3A-B3B6-96D8DF868D99}

Defined in mpengine_etw.dll, which carries the event manifest.

WS2022-20348.4893, sample captured from a live trace, binary version 1.1.26040.8, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, sample captured from a live trace, binary version 1.1.26040.8, captured 2026-06-02 — Manifest XML pack, 2.0 MB
WS2022-20348.4893, schema read from the registered manifest, binary version 1.1.26040.8, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 1.1.26040.8, captured 2026-06-02 — Manifest XML pack, 2.0 MB