detection.wiki

Microsoft-Windows-Crypto-CNG

EventTitleChannelSampleRule
1Open Provider Failure.AnalyticNN

Event ID 1: Open Provider Failure.

#
Channel
Analytic
Opcode
Info

Message #

Open Provider Failure. 

 Cryptographic Parameters:
 	Provider Name: %1
 	Algorithm Name: %2
 	Flags: %3
 Failure Information:
 	Return Code: %4
 	Failure Type: %5

Fields #

NameDescription
ProviderName UnicodeString
AlgorithmName UnicodeString
dwFlags UInt32
Status HexInt32NTSTATUS reference
OperationType UInt32
Known values
%%1904
New registry value created
%%1905
Existing registry value modified
%%1906
Registry value deleted
%%14674
Value Added
%%14675
Value Deleted
%%14680
Value Added With Expiration Time
%%14681
Value Deleted With Expiration Time
%%14688
Value Auto Deleted With Expiration Time

Provenance

ETW provider GUID e3e0e2f0-c9c5-11e0-8ab9-9ebc4824019b

Defined in cng.sys, the binary that emits these events.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.4648, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB