detection.wiki

Microsoft-Windows-ASN1

EventTitleChannelSampleRule
1Decoding failed.OperationalNN

Event ID 1: Decoding failed.

#
Channel
Operational
Task
Decoding

Message #

Decoding failed:
	Module	%1
	PDU	%2
	Object	%3
	Status	%4
	Data length	%5
	
	See Details for the first %6 bytes of encoded data.

Fields #

NameDescription
Module UnicodeString
PDU UInt32
Object AnsiString
Status HexInt32NTSTATUS reference
TotalEncodedLength UInt32
EncodedLength UInt32
Encoded Binary

Provenance

ETW provider GUID d92ef8ac-99dd-4ab8-b91d-c6eba85f3755

Defined in ntasn1.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB