detection.wiki

Microsoft-Windows-AsynchronousCausality

EventTitleChannelSampleRule
4112Event fired when an asynchronous operation is created.CausalityYN
4113Event fired when an asynchronous operation is created.CausalityYN
4114Event fired when an asynchronous operation is created.CausalityNN
4144Event fired when an asynchronous operation is created.CausalityNN
4145Event fired when an asynchronous operation is created.CausalityNN
4146Event fired when an asynchronous operation is created.CausalityNN
4176Event fired when an asynchronous operation is created.CausalityNN
4177Event fired when an asynchronous operation is created.CausalityNN
4178Event fired when an asynchronous operation is created.CausalityNN
8208Event fired when an asynchronous operation is completed.CausalityYN
8209Event fired when an asynchronous operation is completed.CausalityYN
8210Event fired when an asynchronous operation is completed.CausalityNN
8240Event fired when an asynchronous operation is completed.CausalityNN
8241Event fired when an asynchronous operation is completed.CausalityNN
8242Event fired when an asynchronous operation is completed.CausalityNN
8272Event fired when an asynchronous operation is completed.CausalityNN
8273Event fired when an asynchronous operation is completed.CausalityNN
8274Event fired when an asynchronous operation is completed.CausalityNN
12304Event fired relating a synchronous work items to an asynchronous operation.CausalityNN
12305Event fired relating a synchronous work items to an asynchronous operation.CausalityNN
12306Event fired relating a synchronous work items to an asynchronous operation.CausalityNN
12336Event fired relating a synchronous work items to an asynchronous operation.CausalityNN
12337Event fired relating a synchronous work items to an asynchronous operation.CausalityYN
12338Event fired relating a synchronous work items to an asynchronous operation.CausalityNN
12368Event fired relating a synchronous work items to an asynchronous operation.CausalityYN
12369Event fired relating a synchronous work items to an asynchronous operation.CausalityNN
12370Event fired relating a synchronous work items to an asynchronous operation.CausalityNN
16400Event fired when a synchronous work item starts.CausalityYN
16401Event fired when a synchronous work item starts.CausalityYN
16402Event fired when a synchronous work item starts.CausalityNN
16432Event fired when a synchronous work item starts.CausalityNN
16433Event fired when a synchronous work item starts.CausalityNN
16434Event fired when a synchronous work item starts.CausalityNN
16464Event fired when a synchronous work item starts.CausalityNN
16465Event fired when a synchronous work item starts.CausalityNN
16466Event fired when a synchronous work item starts.CausalityNN
16656Event fired when a synchronous work item starts.CausalityYN
16657Event fired when a synchronous work item starts.CausalityYN
16658Event fired when a synchronous work item starts.CausalityNN
16688Event fired when a synchronous work item starts.CausalityNN
16689Event fired when a synchronous work item starts.CausalityNN
16690Event fired when a synchronous work item starts.CausalityNN
16720Event fired when a synchronous work item starts.CausalityNN
16721Event fired when a synchronous work item starts.CausalityNN
16722Event fired when a synchronous work item starts.CausalityNN
20496Event fired when a synchronous work item completes.CausalityYN
20497Event fired when a synchronous work item completes.CausalityYN
20498Event fired when a synchronous work item completes.CausalityNN
20528Event fired when a synchronous work item completes.CausalityNN
20529Event fired when a synchronous work item completes.CausalityNN
20530Event fired when a synchronous work item completes.CausalityNN
20560Event fired when a synchronous work item completes.CausalityNN
20561Event fired when a synchronous work item completes.CausalityNN
20562Event fired when a synchronous work item completes.CausalityNN
20752Event fired when a synchronous work item completes.CausalityYN
20753Event fired when a synchronous work item completes.CausalityYN
20754Event fired when a synchronous work item completes.CausalityNN
20784Event fired when a synchronous work item completes.CausalityNN
20785Event fired when a synchronous work item completes.CausalityNN
20786Event fired when a synchronous work item completes.CausalityNN
20816Event fired when a synchronous work item completes.CausalityNN
20817Event fired when a synchronous work item completes.CausalityNN
20818Event fired when a synchronous work item completes.CausalityNN

Event ID 4112: Event fired when an asynchronous operation is created.

#
Channel
Causality
Also via
realtime ETW trace
Level
Critical

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
OperationName UnicodeString
RelatedId UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AsynchronousCausality",
    "guid": "{19A4C69A-28EB-4D4B-8D94-5F19055A1B5C}",
    "event_source_name": "",
    "event_id": 4112,
    "version": 1,
    "level": 1,
    "task": 0,
    "opcode": 0,
    "keywords": "0x0000000000000901",
    "time_created": "2026-06-02T05:18:54.447+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{1D5E31DB-30E2-4C9E-A8B8-ADD03FC063BA}"
    },
    "execution": {
      "process_id": 14404,
      "thread_id": 5356
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "OperationId": 2070815322032,
    "OperationName": "Windows.Foundation.AsyncOperationCompletedHandler`1<Windows.Internal.Security.WebAuthentication.UserHostIdentity>",
    "PlatformId": "{C54C95D9-5B6E-41E9-A28D-2DD68F94B500}",
    "RelatedId": 1
  },
  "message": ""
}

Event ID 4113: Event fired when an asynchronous operation is created.

#
Channel
Causality
Also via
realtime ETW trace
Level
Critical

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
OperationName UnicodeString
RelatedId UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AsynchronousCausality",
    "guid": "{19a4c69a-28eb-4d4b-8d94-5f19055a1b5c}",
    "event_source_name": "",
    "event_id": "4113",
    "version": "1",
    "level": "1",
    "task": "0",
    "opcode": "0",
    "keywords": 9223372036854778369,
    "time_created": "2026-03-15T04:33:35.817157300+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{210931ca-a6a8-4616-8759-b99b1b76542e}"
    },
    "execution": {
      "process_id": "5820",
      "thread_id": "12172"
    },
    "channel": "Microsoft-Windows-AsynchronousCausality/Causality",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "PlatformId": "{4b0171a6-f3d0-41a0-9b33-02550652b995}",
    "OperationId": "4294967297",
    "OperationName": "Task: <Init>b__0_0",
    "RelatedId": "0"
  },
  "message": ""
}

Event ID 4114: Event fired when an asynchronous operation is created.

#
Channel
Causality

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
OperationName UnicodeString
RelatedId UInt64

Event ID 4144: Event fired when an asynchronous operation is created.

#
Channel
Causality

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
OperationName UnicodeString
RelatedId UInt64

Event ID 4145: Event fired when an asynchronous operation is created.

#
Channel
Causality

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
OperationName UnicodeString
RelatedId UInt64

Event ID 4146: Event fired when an asynchronous operation is created.

#
Channel
Causality

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
OperationName UnicodeString
RelatedId UInt64

Event ID 4176: Event fired when an asynchronous operation is created.

#
Channel
Causality

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
OperationName UnicodeString
RelatedId UInt64

Event ID 4177: Event fired when an asynchronous operation is created.

#
Channel
Causality

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
OperationName UnicodeString
RelatedId UInt64

Event ID 4178: Event fired when an asynchronous operation is created.

#
Channel
Causality

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
OperationName UnicodeString
RelatedId UInt64

Event ID 8208: Event fired when an asynchronous operation is completed.

#
Channel
Causality
Also via
realtime ETW trace
Level
Critical

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
CompletionStatus UInt8

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AsynchronousCausality",
    "guid": "{19A4C69A-28EB-4D4B-8D94-5F19055A1B5C}",
    "event_source_name": "",
    "event_id": 8208,
    "version": 1,
    "level": 1,
    "task": 0,
    "opcode": 0,
    "keywords": "0x0000000000000101",
    "time_created": "2026-06-02T05:18:54.648+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{1D5E31DB-30E2-4C9E-A8B8-ADD03FC063BA}"
    },
    "execution": {
      "process_id": 14404,
      "thread_id": 5356
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "CompletionStatus": 1,
    "OperationId": 2070815322032,
    "PlatformId": "{C54C95D9-5B6E-41E9-A28D-2DD68F94B500}"
  },
  "message": ""
}

Event ID 8209: Event fired when an asynchronous operation is completed.

#
Channel
Causality
Also via
realtime ETW trace
Level
Critical

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
CompletionStatus UInt8

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AsynchronousCausality",
    "guid": "{19a4c69a-28eb-4d4b-8d94-5f19055a1b5c}",
    "event_source_name": "",
    "event_id": "8209",
    "version": "1",
    "level": "1",
    "task": "0",
    "opcode": "0",
    "keywords": 9223372036854776321,
    "time_created": "2026-03-15T04:33:36.031909300+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{4d4d0280-ef8f-4702-be81-37791e0104ea}"
    },
    "execution": {
      "process_id": "5820",
      "thread_id": "8500"
    },
    "channel": "Microsoft-Windows-AsynchronousCausality/Causality",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "PlatformId": "{4b0171a6-f3d0-41a0-9b33-02550652b995}",
    "OperationId": "4294967297",
    "CompletionStatus": "1"
  },
  "message": ""
}

Event ID 8210: Event fired when an asynchronous operation is completed.

#
Channel
Causality

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
CompletionStatus UInt8

Event ID 8240: Event fired when an asynchronous operation is completed.

#
Channel
Causality

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
CompletionStatus UInt8

Event ID 8241: Event fired when an asynchronous operation is completed.

#
Channel
Causality

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
CompletionStatus UInt8

Event ID 8242: Event fired when an asynchronous operation is completed.

#
Channel
Causality

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
CompletionStatus UInt8

Event ID 8272: Event fired when an asynchronous operation is completed.

#
Channel
Causality

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
CompletionStatus UInt8

Event ID 8273: Event fired when an asynchronous operation is completed.

#
Channel
Causality

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
CompletionStatus UInt8

Event ID 8274: Event fired when an asynchronous operation is completed.

#
Channel
Causality

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
CompletionStatus UInt8

Event ID 12304: Event fired relating a synchronous work items to an asynchronous operation.

#
Channel
Causality

Message #

Event fired relating a synchronous work items to  an asynchronous operation.

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
Relation UInt8

Event ID 12305: Event fired relating a synchronous work items to an asynchronous operation.

#
Channel
Causality

Message #

Event fired relating a synchronous work items to  an asynchronous operation.

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
Relation UInt8

Event ID 12306: Event fired relating a synchronous work items to an asynchronous operation.

#
Channel
Causality

Message #

Event fired relating a synchronous work items to  an asynchronous operation.

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
Relation UInt8

Event ID 12336: Event fired relating a synchronous work items to an asynchronous operation.

#
Channel
Causality

Message #

Event fired relating a synchronous work items to  an asynchronous operation.

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
Relation UInt8

Event ID 12337: Event fired relating a synchronous work items to an asynchronous operation.

#
Channel
Causality
Also via
realtime ETW trace
Level
Warning

Message #

Event fired relating a synchronous work items to  an asynchronous operation.

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
Relation UInt8

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AsynchronousCausality",
    "guid": "{19A4C69A-28EB-4D4B-8D94-5F19055A1B5C}",
    "event_source_name": "",
    "event_id": 12337,
    "version": 1,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": "0x0000000000000204",
    "time_created": "2026-06-02T05:18:56.002+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{AC9D7E53-4EF9-4D5D-8A6F-E34D92913C3D}"
    },
    "execution": {
      "process_id": 12356,
      "thread_id": 14396
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "OperationId": 4294967507,
    "PlatformId": "{4B0171A6-F3D0-41A0-9B33-02550652B995}",
    "Relation": 0
  },
  "message": ""
}

Event ID 12338: Event fired relating a synchronous work items to an asynchronous operation.

#
Channel
Causality

Message #

Event fired relating a synchronous work items to  an asynchronous operation.

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
Relation UInt8

Event ID 12368: Event fired relating a synchronous work items to an asynchronous operation.

#
Channel
Causality
Also via
realtime ETW trace
Level
Verbose

Message #

Event fired relating a synchronous work items to  an asynchronous operation.

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
Relation UInt8

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AsynchronousCausality",
    "guid": "{19A4C69A-28EB-4D4B-8D94-5F19055A1B5C}",
    "event_source_name": "",
    "event_id": 12368,
    "version": 1,
    "level": 5,
    "task": 0,
    "opcode": 0,
    "keywords": "0x0000000000000104",
    "time_created": "2026-06-02T05:18:54.648+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{1D5E31DB-30E2-4C9E-A8B8-ADD03FC063BA}"
    },
    "execution": {
      "process_id": 14404,
      "thread_id": 5356
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "OperationId": 2070815322032,
    "PlatformId": "{C54C95D9-5B6E-41E9-A28D-2DD68F94B500}",
    "Relation": 0
  },
  "message": ""
}

Event ID 12369: Event fired relating a synchronous work items to an asynchronous operation.

#
Channel
Causality

Message #

Event fired relating a synchronous work items to  an asynchronous operation.

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
Relation UInt8

Event ID 12370: Event fired relating a synchronous work items to an asynchronous operation.

#
Channel
Causality

Message #

Event fired relating a synchronous work items to  an asynchronous operation.

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
Relation UInt8

Event ID 16400: Event fired when a synchronous work item starts.

#
Channel
Causality
Also via
realtime ETW trace
Level
Critical

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
WorkItemType UInt8

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AsynchronousCausality",
    "guid": "{19A4C69A-28EB-4D4B-8D94-5F19055A1B5C}",
    "event_source_name": "",
    "event_id": 16400,
    "version": 1,
    "level": 1,
    "task": 0,
    "opcode": 0,
    "keywords": "0x0000000000000102",
    "time_created": "2026-06-02T05:18:54.648+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{1D5E31DB-30E2-4C9E-A8B8-ADD03FC063BA}"
    },
    "execution": {
      "process_id": 14404,
      "thread_id": 5356
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "OperationId": 2070815322032,
    "PlatformId": "{C54C95D9-5B6E-41E9-A28D-2DD68F94B500}",
    "WorkItemType": 0
  },
  "message": ""
}

Event ID 16401: Event fired when a synchronous work item starts.

#
Channel
Causality
Also via
realtime ETW trace
Level
Critical

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
WorkItemType UInt8

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AsynchronousCausality",
    "guid": "{19a4c69a-28eb-4d4b-8d94-5f19055a1b5c}",
    "event_source_name": "",
    "event_id": "16401",
    "version": "1",
    "level": "1",
    "task": "0",
    "opcode": "0",
    "keywords": 9223372036854776322,
    "time_created": "2026-03-15T04:33:37.049123200+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{90556757-5b90-44b0-97d0-2daf7e5a760e}"
    },
    "execution": {
      "process_id": "5820",
      "thread_id": "2804"
    },
    "channel": "Microsoft-Windows-AsynchronousCausality/Causality",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "PlatformId": "{4b0171a6-f3d0-41a0-9b33-02550652b995}",
    "OperationId": "4294967306",
    "WorkItemType": "0"
  },
  "message": ""
}

Event ID 16402: Event fired when a synchronous work item starts.

#
Channel
Causality

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
WorkItemType UInt8

Event ID 16432: Event fired when a synchronous work item starts.

#
Channel
Causality

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
WorkItemType UInt8

Event ID 16433: Event fired when a synchronous work item starts.

#
Channel
Causality

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
WorkItemType UInt8

Event ID 16434: Event fired when a synchronous work item starts.

#
Channel
Causality

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
WorkItemType UInt8

Event ID 16464: Event fired when a synchronous work item starts.

#
Channel
Causality

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
WorkItemType UInt8

Event ID 16465: Event fired when a synchronous work item starts.

#
Channel
Causality

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
WorkItemType UInt8

Event ID 16466: Event fired when a synchronous work item starts.

#
Channel
Causality

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
WorkItemType UInt8

Event ID 16656: Event fired when a synchronous work item starts.

#
Channel
Causality
Level
Critical

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
WorkItemType UInt8

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-AsynchronousCausality/Causality",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 16656,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 8992,
      "thread_id": 9672
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-AsynchronousCausality",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 23:53:15.480Z",
    "version": 0
  },
  "event_data": {
    "OperationId": 244552184,
    "PlatformId": "{C54C95D9-5B6E-41E9-A28D-2DD68F94B500}",
    "WorkItemType": 2
  },
  "message": ""
}

Event ID 16657: Event fired when a synchronous work item starts.

#
Channel
Causality
Also via
realtime ETW trace
Level
Critical

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
WorkItemType UInt8

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AsynchronousCausality",
    "guid": "{19a4c69a-28eb-4d4b-8d94-5f19055a1b5c}",
    "event_source_name": "",
    "event_id": "16657",
    "version": "1",
    "level": "1",
    "task": "0",
    "opcode": "0",
    "keywords": 9223372036854776336,
    "time_created": "2026-03-15T04:33:35.818197800+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{4d4d0280-ef8f-4702-be81-37791e0104ea}"
    },
    "execution": {
      "process_id": "5820",
      "thread_id": "8500"
    },
    "channel": "Microsoft-Windows-AsynchronousCausality/Causality",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "PlatformId": "{4b0171a6-f3d0-41a0-9b33-02550652b995}",
    "OperationId": "4294967297",
    "WorkItemType": "2"
  },
  "message": ""
}

Event ID 16658: Event fired when a synchronous work item starts.

#
Channel
Causality

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
WorkItemType UInt8

Event ID 16688: Event fired when a synchronous work item starts.

#
Channel
Causality

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
WorkItemType UInt8

Event ID 16689: Event fired when a synchronous work item starts.

#
Channel
Causality

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
WorkItemType UInt8

Event ID 16690: Event fired when a synchronous work item starts.

#
Channel
Causality

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
WorkItemType UInt8

Event ID 16720: Event fired when a synchronous work item starts.

#
Channel
Causality

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
WorkItemType UInt8

Event ID 16721: Event fired when a synchronous work item starts.

#
Channel
Causality

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
WorkItemType UInt8

Event ID 16722: Event fired when a synchronous work item starts.

#
Channel
Causality

Fields #

NameDescription
PlatformId GUID
OperationId UInt64
WorkItemType UInt8

Event ID 20496: Event fired when a synchronous work item completes.

#
Channel
Causality
Level
Critical

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AsynchronousCausality",
    "guid": "{19A4C69A-28EB-4D4B-8D94-5F19055A1B5C}",
    "event_source_name": "",
    "event_id": 20496,
    "version": 1,
    "level": 1,
    "task": 0,
    "opcode": 0,
    "keywords": "0x0000000000000102",
    "time_created": "2026-06-02T05:18:54.648+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{1D5E31DB-30E2-4C9E-A8B8-ADD03FC063BA}"
    },
    "execution": {
      "process_id": 14404,
      "thread_id": 5356
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 20497: Event fired when a synchronous work item completes.

#
Channel
Causality
Level
Critical

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AsynchronousCausality",
    "guid": "{19a4c69a-28eb-4d4b-8d94-5f19055a1b5c}",
    "event_source_name": "",
    "event_id": "20497",
    "version": "1",
    "level": "1",
    "task": "0",
    "opcode": "0",
    "keywords": 9223372036854776322,
    "time_created": "2026-03-15T04:33:37.049158900+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{90556757-5b90-44b0-97d0-2daf7e5a760e}"
    },
    "execution": {
      "process_id": "5820",
      "thread_id": "2804"
    },
    "channel": "Microsoft-Windows-AsynchronousCausality/Causality",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 20498: Event fired when a synchronous work item completes.

#
Channel
Causality

Event ID 20528: Event fired when a synchronous work item completes.

#
Channel
Causality

Event ID 20529: Event fired when a synchronous work item completes.

#
Channel
Causality

Event ID 20530: Event fired when a synchronous work item completes.

#
Channel
Causality

Event ID 20560: Event fired when a synchronous work item completes.

#
Channel
Causality

Event ID 20561: Event fired when a synchronous work item completes.

#
Channel
Causality

Event ID 20562: Event fired when a synchronous work item completes.

#
Channel
Causality

Event ID 20752: Event fired when a synchronous work item completes.

#
Channel
Causality
Level
Critical

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-AsynchronousCausality/Causality",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 20752,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 8992,
      "thread_id": 9672
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-AsynchronousCausality",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 23:53:15.481Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 20753: Event fired when a synchronous work item completes.

#
Channel
Causality
Level
Critical

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AsynchronousCausality",
    "guid": "{19a4c69a-28eb-4d4b-8d94-5f19055a1b5c}",
    "event_source_name": "",
    "event_id": "20753",
    "version": "1",
    "level": "1",
    "task": "0",
    "opcode": "0",
    "keywords": 9223372036854776336,
    "time_created": "2026-03-15T04:33:36.031900500+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{4d4d0280-ef8f-4702-be81-37791e0104ea}"
    },
    "execution": {
      "process_id": "5820",
      "thread_id": "8500"
    },
    "channel": "Microsoft-Windows-AsynchronousCausality/Causality",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 20754: Event fired when a synchronous work item completes.

#
Channel
Causality

Event ID 20784: Event fired when a synchronous work item completes.

#
Channel
Causality

Event ID 20785: Event fired when a synchronous work item completes.

#
Channel
Causality

Event ID 20786: Event fired when a synchronous work item completes.

#
Channel
Causality

Event ID 20816: Event fired when a synchronous work item completes.

#
Channel
Causality

Event ID 20817: Event fired when a synchronous work item completes.

#
Channel
Causality

Event ID 20818: Event fired when a synchronous work item completes.

#
Channel
Causality

Provenance

ETW provider GUID {19A4C69A-28EB-4D4B-8D94-5F19055A1B5C}

Defined in combase.dll, which carries the event manifest.

  • WS2022-20348.4893, sample captured from a live trace, binary version 10.0.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB