detection.wiki

Microsoft-User Experience Virtualization-IPC

EventTitleChannelSampleRule
100_String1.OperationalNN

Event ID 100: _String1.

#
Channel
Operational

Message #

%1

Fields #

NameDescription
_String1 UnicodeString

Provenance

ETW provider GUID 21d79db0-8e03-41cd-9589-f3ef7001a92a

Defined in Microsoft.Uev.EventLogMessages.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02