Microsoft.Windows.Console.Host

Title	Sample	Rule
API_GetConsoleMode	Y	N
ApiCall	Y	N
WindowViewport	Y	N
API_WriteConsole	Y	N
API_GetConsoleScreenBufferInfo	Y	N
API_SetConsoleTextAttribute	Y	N
ActivityStart	Y	N
ConsoleAttachDetach	Y	N
Failure	Y	N

API_GetConsoleMode

Level: 4

Fields #

Name	Description
`Handle type`
`Mode`

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 12124,
      "thread_id": 12236
    },
    "guid": "FE1FF234-1F09-50A8-D38D-C44FAB43E818",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Console.Host",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:37:32.202Z",
    "version": 0
  },
  "event_data": {
    "Handle type": "0C006F0075007400700075007400",
    "Mode": "03000000"
  },
  "message": ""
}

ApiCall

Level: 4

Fields #

Name	Description
`ApiName`
`Result`

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 5720,
      "thread_id": 12476
    },
    "guid": "FE1FF234-1F09-50A8-D38D-C44FAB43E818",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft.Windows.Console.Host",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:37:27.902Z",
    "version": 0
  },
  "event_data": {
    "ApiName": "GetConsoleLangId",
    "Result": 0
  },
  "message": ""
}

WindowViewport

Level: 4

Fields #

Name	Description
`OriginLeft`
`OriginTop`
`ViewHeight`
`ViewWidth`

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 9356,
      "thread_id": 1196
    },
    "guid": "FE1FF234-1F09-50A8-D38D-C44FAB43E818",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Console.Host",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:37:38.969Z",
    "version": 0
  },
  "event_data": {
    "OriginLeft": 0,
    "OriginTop": 1047,
    "ViewHeight": 44,
    "ViewWidth": 120
  },
  "message": ""
}

API_WriteConsole

Level: 4

Fields #

Name	Description
`NumBytes`
`Unicode`
`input buffer`

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 12124,
      "thread_id": 12236
    },
    "guid": "FE1FF234-1F09-50A8-D38D-C44FAB43E818",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Console.Host",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:37:32.279Z",
    "version": 0
  },
  "event_data": {
    "NumBytes": 10,
    "Unicode": 1,
    "input buffer": "0A006800690020000D000A00"
  },
  "message": ""
}

API_GetConsoleScreenBufferInfo

Level: 4

Fields #

Name	Description
`Attributes`
`ColorTable`
`CurrentWindowSize.X`
`CurrentWindowSize.Y`
`CursorPosition.X`
`CursorPosition.Y`
`FullscreenSupported`
`MaximumWindowSize.X`
`MaximumWindowSize.Y`
`PopupAttributes`
`ScrollPosition.X`
`ScrollPosition.Y`
`Size.X`
`Size.Y`

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 9356,
      "thread_id": 1196
    },
    "guid": "FE1FF234-1F09-50A8-D38D-C44FAB43E818",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Console.Host",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:37:38.956Z",
    "version": 0
  },
  "event_data": {
    "Attributes": 86,
    "ColorTable": "0C0C0C00",
    "CurrentWindowSize.X": 120,
    "CurrentWindowSize.Y": 44,
    "CursorPosition.X": 0,
    "CursorPosition.Y": 1089,
    "FullscreenSupported": 0,
    "MaximumWindowSize.X": 120,
    "MaximumWindowSize.Y": 45,
    "PopupAttributes": 243,
    "ScrollPosition.X": 0,
    "ScrollPosition.Y": 1046,
    "Size.X": 120,
    "Size.Y": 3000
  },
  "message": ""
}

API_SetConsoleTextAttribute

Level: 4

Fields #

Name	Description
`Attributes`

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 9356,
      "thread_id": 1196
    },
    "guid": "FE1FF234-1F09-50A8-D38D-C44FAB43E818",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Console.Host",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:37:38.967Z",
    "version": 0
  },
  "event_data": {
    "Attributes": 86
  },
  "message": ""
}

ActivityStart

Level: 4

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7612,
      "thread_id": 13120
    },
    "guid": "FE1FF234-1F09-50A8-D38D-C44FAB43E818",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft.Windows.Console.Host",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:37:28.577Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

ConsoleAttachDetach

Level: 4

Fields #

Name	Description
`AttachedProcessCreationTime`
`AttachedProcessId`
`IsAttach`
`IsUserInteractive`

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7612,
      "thread_id": 13120
    },
    "guid": "FE1FF234-1F09-50A8-D38D-C44FAB43E818",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Console.Host",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:37:28.616Z",
    "version": 0
  },
  "event_data": {
    "AttachedProcessCreationTime": 134291326485181796,
    "AttachedProcessId": 12388,
    "IsAttach": true,
    "IsUserInteractive": false
  },
  "message": ""
}

Failure

Level: 4

Fields #

Name	Description
`CallingContext`
`Code`
`File`
`Function`
`HResult`
`LineNumber`
`Message`
`Module`
`Site`

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7612,
      "thread_id": 13120
    },
    "guid": "FE1FF234-1F09-50A8-D38D-C44FAB43E818",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Console.Host",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:37:28.586Z",
    "version": 0
  },
  "event_data": {
    "CallingContext": "",
    "Code": "",
    "File": "onecore\\windows\\core\\console\\open\\src\\interactivity\\win32\\systemconfigurationprovider.cpp",
    "Function": "",
    "HResult": "05400080",
    "LineNumber": 194,
    "Message": "",
    "Module": "conhost.exe",
    "Site": "EF26AE02F67F0000"
  },
  "message": ""
}