Microsoft-Windows-Dism-Cli

Event	Title	Channel	Sample	Rule
1	DismCliCloseSessionStart	Analytic	N	N
2	DismCliCloseSessionStop	Analytic	N	N
3	DismCliLoadDismStart	Analytic	N	N
4	DismCliLoadDismStop	Analytic	N	N
5	DismCliExecuteCmdLineStart	Analytic	N	N
6	DismCliExecuteCmdLineStop	Analytic	N	N
7	DismCliLoadImageSessionStart	Analytic	N	N
8	DismCliLoadImageSessionStop	Analytic	N	N

Event ID 1: DismCliCloseSessionStart

Channel: Analytic
Task: DismCliCloseSession
Opcode: Start

Event ID 2: DismCliCloseSessionStop

Channel: Analytic
Task: DismCliCloseSession
Opcode: Stop

Event ID 3: DismCliLoadDismStart

Channel: Analytic
Task: DismCliLoadDism
Opcode: Start

Event ID 4: DismCliLoadDismStop

Channel: Analytic
Task: DismCliLoadDism
Opcode: Stop

Event ID 5: DismCliExecuteCmdLineStart

Channel: Analytic
Task: DismCliExecuteCmdLine
Opcode: Start

Event ID 6: DismCliExecuteCmdLineStop

Channel: Analytic
Task: DismCliExecuteCmdLine
Opcode: Stop

Event ID 7: DismCliLoadImageSessionStart

Channel: Analytic
Task: DismCliLoadImageSession
Opcode: Start

Event ID 8: DismCliLoadImageSessionStop

Channel: Analytic
Task: DismCliLoadImageSession
Opcode: Stop

Provenance

ETW provider GUID 2f959466-24d4-4972-8729-0d5e3539ebc3

Defined in Dism.exe, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4946, captured 2026-06-02 — Manifest XML pack, 2.0 MB