detection.wiki

Microsoft-Windows-ActionQueue

EventTitleChannelSampleRule
1001Processing Action Queue "QueueFile".AnalyticNN
1002Finished processing Action Queue with status ErrorCode.AnalyticNN
2001Executing "ExecutableName" with arguments "Arguments" for component "Identity" …AnalyticNN
2002Command completed with status ErrorCode.AnalyticNN

Event ID 1001: Processing Action Queue "QueueFile".

#
Channel
Analytic
Task
ProcessActionQueue
Opcode
Start

Message #

Processing Action Queue "%1".

Fields #

NameDescription
QueueFile UnicodeString

Event ID 1002: Finished processing Action Queue with status ErrorCode.

#
Channel
Analytic
Task
ProcessActionQueue
Opcode
Stop

Message #

Finished processing Action Queue with status %1.

Fields #

NameDescription
ErrorCode UInt32

Event ID 2001: Executing "ExecutableName" with arguments "Arguments" for component "Identity" in unattend pass "Pass".

#
Channel
Analytic
Task
ExecuteCommand
Opcode
Start

Message #

Executing "%1" with arguments "%2" for component "%3" in unattend pass "%4".

Fields #

NameDescription
ExecutableName AnsiString
Arguments AnsiString
Identity AnsiString
Pass AnsiString

Event ID 2002: Command completed with status ErrorCode.

#
Channel
Analytic
Task
ExecuteCommand
Opcode
Stop

Message #

Command completed with status %1.

Fields #

NameDescription
ErrorCode UInt32

Provenance

ETW provider GUID 0dd4d48e-2bbf-452f-a7ec-ba3dba8407ae

Defined in actionqueue.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB