detection.wiki

Microsoft-Windows-EtwCollector

EventTitleChannelSampleRule
1Profiling for target ({ProcessID}) has started.OperationalNN
2Profiling for target ({ProcessID}) has stopped.OperationalNN
5Machine [Name: {Name}] [OS Description: {OSDescription}] [Architecture: …OperationalNN

Event ID 1: Profiling for target ({ProcessID}) has started.

#
Channel
Operational

Fields #

NameDescription
ProcessID

Event ID 2: Profiling for target ({ProcessID}) has stopped.

#
Channel
Operational

Fields #

NameDescription
ProcessID

Event ID 5: Machine [Name: {Name}] [OS Description: {OSDescription}] [Architecture: {Architecture}].

#
Channel
Operational

Fields #

NameDescription
Name
OSDescription
Architecture