detection.wiki

Microsoft-ServerCore-ShellLauncher

EventTitleChannelSampleRule
301Message.DebugNN
302Message.DebugNN
303Message.DebugNN
304Message.DebugNN

Event ID 301: Message.

#
Channel
Debug

Message #

%1

Fields #

NameDescription
Message UnicodeString

Event ID 302: Message.

#
Channel
Debug

Message #

%1

Fields #

NameDescription
Message UnicodeString

Event ID 303: Message.

#
Channel
Debug

Message #

%1

Fields #

NameDescription
Message UnicodeString

Event ID 304: Message.

#
Channel
Debug

Message #

%1

Fields #

NameDescription
Message UnicodeString

Provenance

ETW provider GUID 398f5476-de18-5aee-9a34-a42464610946

Defined in servercoreshelllauncherevents.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB