detection.wiki

Microsoft-Windows-Crypto-BCrypt

EventTitleChannelSampleRule
1Open Provider Failure.AnalyticNN

Event ID 1: Open Provider Failure.

#
Channel
Analytic
Opcode
Info

Message #

Open Provider Failure. 

 Cryptographic Parameters:
 	Provider Name: %1
 	Algorithm Name: %2
 	Flags: %3
 Failure Information:
 	Return Code: %4
 	Failure Type: %5

Fields #

NameDescription
ProviderName UnicodeString
AlgorithmName UnicodeString
dwFlags UInt32
Status HexInt32NTSTATUS reference
OperationType UInt32
Known values
%%1904
New registry value created
%%1905
Existing registry value modified
%%1906
Registry value deleted
%%14674
Value Added
%%14675
Value Deleted
%%14680
Value Added With Expiration Time
%%14681
Value Deleted With Expiration Time
%%14688
Value Auto Deleted With Expiration Time

Provenance

ETW provider GUID c7e089ac-ba2a-11e0-9af7-68384824019b

Defined in bcrypt.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB