detection.wiki

Microsoft-Windows-AccelLib-AccelCx

EventTitleChannelSampleRule
1AccelCx Accelerator Added.OperationalNN
2AccelCx Accelerator Removed.OperationalNN

Event ID 1: AccelCx Accelerator Added.

#
Channel
Operational

Description

AccelCx Accelerator Added. Type HardwareType, SubType HardwareSubtype, InstanceId InstanceId, NumaNode NumaNode, AcceleratorCountOnThisNode AcceleratorCountOnThisNode.

Message #

AccelCx Accelerator Added. Type %1, SubType %2, InstanceId %3, NumaNode %4, AcceleratorCountOnThisNode %5

Fields #

NameDescription
HardwareType UInt32
HardwareSubtype UInt32
InstanceId UnicodeString
NumaNode UInt32
AcceleratorCountOnThisNode UInt32

Event ID 2: AccelCx Accelerator Removed.

#
Channel
Operational

Description

AccelCx Accelerator Removed. Type HardwareType, SubType HardwareSubtype, InstanceId InstanceId, NumaNode NumaNode.

Message #

AccelCx Accelerator Removed. Type %1, SubType %2, InstanceId %3, NumaNode %4

Fields #

NameDescription
HardwareType UInt32
HardwareSubtype UInt32
InstanceId UnicodeString
NumaNode UInt32

Provenance

ETW provider GUID 9c4cf201-dd11-5e35-9de5-2c2146832011

Defined in WinAccelCx.sys, the binary that emits these events.

  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1150, captured 2026-06-02 — Manifest XML pack, 2.0 MB