Microsoft-Windows-CoreWindow

Event	Title	Channel	Sample	Rule
1001	CreateCoreWindowStart	Analytic	N	N
1002	CreateCoreWindowStop	Analytic	N	N
1003	PointerDownStart	Analytic	N	N
1004	PointerDownStop	Analytic	N	N
1005	PointerEnterStart	Analytic	N	N
1006	PointerEnterStop	Analytic	N	N

Event ID 1001: CreateCoreWindowStart

Channel: Analytic
Task: CreateCoreWindow
Opcode: Start

Event ID 1002: CreateCoreWindowStop

Channel: Analytic
Task: CreateCoreWindow
Opcode: Stop

Event ID 1003: PointerDownStart

Channel: Analytic
Task: PointerDown
Opcode: Start

Fields #

Name	Description
`PointerId` UInt32

Event ID 1004: PointerDownStop

Channel: Analytic
Task: PointerDown
Opcode: Stop

Fields #

Name	Description
`PointerId` UInt32

Event ID 1005: PointerEnterStart

Channel: Analytic
Task: PointerEnter
Opcode: Start

Fields #

Name	Description
`PointerId` UInt32

Event ID 1006: PointerEnterStop

Channel: Analytic
Task: PointerEnter
Opcode: Stop

Fields #

Name	Description
`PointerId` UInt32

Provenance

ETW provider GUID a3d95055-34cc-4e4a-b99f-ec88f5370495

Defined in windows.ui.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB