detection.wiki

Microsoft-Windows-Diagnosis-WDI

EventTitleChannelSampleRule
140The Diagnostic Policy Service encountered an error in file FileName, function …DebugNN
5016The Diagnostic Infrastructure just made a heap allocationOperationalNN
5017The Diagnostic Infrastructure just freed a previously made heap allocationOperationalNN

Event ID 140: The Diagnostic Policy Service encountered an error in file FileName, function FunctionName, line LineNumber: ErrorMessage.

#
Channel
Debug
Task
Debugtask
Opcode
Debugevent

Message #

The Diagnostic Policy Service encountered an error in file %1, function %2, line %3: %4.

Fields #

NameDescription
FileName UnicodeString
FunctionName UnicodeString
LineNumber Int32
ErrorMessage UnicodeString

Event ID 5016: The Diagnostic Infrastructure just made a heap allocation

#
Channel
Operational

Fields #

NameDescription
FileName AnsiString
Line UInt32
Address Pointer
Size Pointer

Event ID 5017: The Diagnostic Infrastructure just freed a previously made heap allocation

#
Channel
Operational

Fields #

NameDescription
FileName AnsiString
Line UInt32
Address Pointer

Provenance

ETW provider GUID e01b1a7c-c5c9-4e67-99a9-5e85acfb2e10

Defined in dps.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB