Microsoft-Windows-AIT
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1 | AitFeature | Operational | N | N |
| 2 | AitParentAitFeature | Operational | N | N |
| 3 | AitAppInfo | Operational | N | N |
| 4 | AitSystemUsageByDll | Operational | N | N |
| 5 | AitSystemUsageByExe | Operational | N | N |
| 6 | AitProcessEnd | Operational | N | N |
| 7 | KitFeature | Operational | N | N |
Event ID 2: AitParentAitFeature
#Fields #
| Name | Description |
|---|---|
cchParentImagePathIncludingNull UInt16 | |
FeatureGuid GUID | |
ParentProcessImageHeaderHash Binary | |
ParentImagePath UnicodeString |
Event ID 3: AitAppInfo
#Fields #
| Name | Description |
|---|---|
cchAppPathIncludingNull UInt16 | |
ApplicationImageHeaderHash Binary | |
AppPath UnicodeString |
Event ID 4: AitSystemUsageByDll
#Fields #
| Name | Description |
|---|---|
Flags Binary | |
cchIdStringIncludingNull UInt16 | |
cchDllPathIncludingNull UInt16 | |
Category UInt32 | |
ManifestVersion UInt32 | |
DllHeaderHash Binary | |
ApplicationImageHeaderHash Binary | |
IdString AnsiString | |
DllPath UnicodeString |
Event ID 5: AitSystemUsageByExe
#Fields #
| Name | Description |
|---|---|
Flags Binary | |
cchIdStringIncludingNull UInt16 | |
Category UInt32 | |
ManifestVersion UInt32 | |
ApplicationImageHeaderHash Binary | |
IdString AnsiString |
Event ID 6: AitProcessEnd
#Provenance
ETW provider GUID 6addabf4-8c54-4eab-bf4f-fbef61b62eb0
Defined in Microsoft-Windows-System-Events.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3932, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB