detection.wiki

Microsoft-Windows-Deplorch

EventTitleChannelSampleRule
1001Starting system services.AnalyticNN
1002Finished starting system services with status ErrorCode.AnalyticNN
2001Running user-provided script: '{CommandLine}'.AnalyticNN
2002Successfully executed script: '{Command}'.AnalyticNN
2003Failed to execute script: '{Command}'.AnalyticNN

Event ID 1001: Starting system services.

#
Channel
Analytic
Task
StartSystemServices
Opcode
Start

Event ID 1002: Finished starting system services with status ErrorCode.

#
Channel
Analytic
Task
StartSystemServices
Opcode
Stop

Message #

Finished starting system services with status %1.

Fields #

NameDescription
ErrorCode UInt32

Event ID 2001: Running user-provided script: '{CommandLine}'.

#
Channel
Analytic

Fields #

NameDescription
CommandLine

Event ID 2002: Successfully executed script: '{Command}'.

#
Channel
Analytic

Description

Successfully executed script: '{Command}'. Exit code is {ExitCode}.

Message #

Successfully executed script: '{Command}'. Exit code is {ExitCode}.

Fields #

NameDescription
Command
ExitCode

Event ID 2003: Failed to execute script: '{Command}'.

#
Channel
Analytic

Description

Failed to execute script: '{Command}'.Exit code is {ExitCode}.

Message #

Failed to execute script: '{Command}'.Exit code is {ExitCode}.

Fields #

NameDescription
Command
ExitCode

Provenance

ETW provider GUID b9da9fe6-ae5f-4f3e-b2fa-8e623c11dc75

Defined in setupetw.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4202, captured 2026-06-02 — Manifest XML pack, 2.0 MB