Microsoft-Windows-COM-RundownInstrumentation
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1 | RundownInstrumentation | RundownInstrumentation | N | N |
| 2 | RundownInstrumentation2 | RundownInstrumentation | N | N |
| 3 | RundownInstrumentation3 | RundownInstrumentation | N | N |
| 4 | RundownInstrumentation4 | RundownInstrumentation | N | N |
| 5 | RundownInstrumentation5 | RundownInstrumentation | N | N |
| 6 | RundownInstrumentation6 | RundownInstrumentation | N | N |
| 7 | RundownInstrumentation7_V1 | RundownInstrumentation | N | N |
| 8 | RundownInstrumentation8 | RundownInstrumentation | N | N |
| 9 | RundownInstrumentation9 | RundownInstrumentation | N | N |
| 10 | RundownInstrumentation10_V1 | RundownInstrumentation | N | N |
| 12 | RundownInstrumentation12 | RundownInstrumentation | N | N |
| 13 | RundownInstrumentation13 | RundownInstrumentation | N | N |
| 14 | RundownInstrumentation14 | RundownInstrumentation | N | N |
| 15 | RundownInstrumentation15 | RundownInstrumentation | Y | N |
| 21 | RundownInstrumentation21 | RundownInstrumentation | Y | N |
| 22 | RundownInstrumentation22 | RundownInstrumentation | N | N |
| 23 | RundownInstrumentation23 | RundownInstrumentation | N | N |
| 24 | RundownInstrumentation24 | RundownInstrumentation | N | N |
Event ID 1: RundownInstrumentation
#Fields #
| Name | Description |
|---|---|
OID UInt64 | |
IID GUID | |
IPID GUID | |
IsFastRundown Boolean |
Event ID 2: RundownInstrumentation2
#Fields #
| Name | Description |
|---|---|
OID UInt64 | |
IID GUID | |
IPID GUID | |
ProxyManagerIUnknown Pointer |
Event ID 7: RundownInstrumentation7_V1
#Fields #
| Name | Description |
|---|---|
OID UInt64 | |
TargetInterface GUID | |
TargetMethod UInt32 | |
IPID GUID | |
ProxyManagerIUnknown Pointer | |
ImplementedInterface1 GUID | |
ImplementedInterface2 GUID | |
ImplementedInterface3 GUID |
Event ID 8: RundownInstrumentation8
#Fields #
| Name | Description |
|---|---|
OID UInt64 | |
TargetInterface GUID | |
TargetMethod UInt32 | |
IPID GUID | |
ProxyManagerIUnknown Pointer |
Event ID 10: RundownInstrumentation10_V1
#Fields #
| Name | Description |
|---|---|
OID UInt64 | |
ClientProcessId UInt32 | |
WhereDetected UInt32 |
Event ID 13: RundownInstrumentation13
#Fields #
| Name | Description |
|---|---|
OID UInt64 | |
ClientProcessId UInt32 | |
Error UInt32 |
Event ID 15: RundownInstrumentation15
#Fields #
| Name | Description |
|---|---|
OID UInt64 | |
ClientProcessId UInt32 |
Example Event #
{
"system": {
"channel": "Microsoft-Windows-COM/RundownInstrumentation",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 15,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 1432,
"thread_id": 3616
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-Windows-COM-RundownInstrumentation",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 08:52:36.814Z",
"version": 0
},
"event_data": {
"ClientProcessId": 10004,
"OID": 13163045571328452484
},
"message": ""
}
Event ID 21: RundownInstrumentation21
#Fields #
| Name | Description |
|---|---|
OID UInt64 | |
WhereIssued UInt32 |
Example Event #
{
"system": {
"channel": "Microsoft-Windows-COM/RundownInstrumentation",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 21,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 1432,
"thread_id": 1468
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-Windows-COM-RundownInstrumentation",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 08:53:56.174Z",
"version": 0
},
"event_data": {
"OID": 13491803788444511437,
"WhereIssued": 1
},
"message": ""
}
Provenance
ETW provider GUID 2957313d-fcaa-5d4a-2f69-32ce5f0ac44e
Defined in combase.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB