Microsoft-Antimalware-Protection

Event	Title	Channel	Sample	Rule
1	FastMemScanStart	Application	N	N
2	FastMemScanStop	Application	N	N
3	AllowedUrlExclusionCheckStart	Application	N	N
4	AllowedUrlExclusionCheckStop	Application	N	N
5	FastMemScanCacheStart	Application	N	N
6	FastMemScanCacheStop	Application	N	N
7	MpData	Application	N	N

Event ID 1: FastMemScanStart

Channel: Application
Task: FastMemScan
Opcode: Start

Fields #

Name	Description
`DwordData` UInt32

Event ID 2: FastMemScanStop

Channel: Application
Task: FastMemScan
Opcode: Stop

Fields #

Name	Description
`DwordData` UInt32

Event ID 3: AllowedUrlExclusionCheckStart

Channel: Application
Task: AllowedUrlExclusionCheck
Opcode: Start

Fields #

Name	Description
`Description` UnicodeString

Event ID 4: AllowedUrlExclusionCheckStop

Channel: Application
Task: AllowedUrlExclusionCheck
Opcode: Stop

Fields #

Name	Description
`DwordData` UInt32

Event ID 5: FastMemScanCacheStart

Channel: Application
Task: FastMemScanCache
Opcode: Start

Event ID 6: FastMemScanCacheStop

Channel: Application
Task: FastMemScanCache
Opcode: Stop

Fields #

Name	Description
`DwordData` UInt32

Event ID 7: MpData

Channel: Application
Task: MpData

Fields #

Name	Description
`Description` UnicodeString

Provenance

ETW provider GUID e4b70372-261f-4c54-8fa6-a5a7914d73da

Defined in Windows, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 4.18.26040.7, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 4.18.26040.7, captured 2026-06-02 — Manifest XML pack, 2.0 MB