Microsoft-Windows-exFAT-SQM

Event	Title	Channel	Sample	Rule
3	task_0	Operational	N	N
4	task_04	Operational	N	N
5	task_05	Operational	N	N
6	task_0Stop	Operational	N	N
7	task_07	Operational	N	N
8	task_08	Operational	N	N
9	task_09	Operational	N	N
10	task_010	Operational	N	N
11	task_011	Operational	N	N
16	task_016	Operational	N	N
17	task_017	Operational	N	N

Event ID 3: task_0

Channel: Operational

Fields #

Name	Description
`SqmType` UInt32
`SqmSessionGuid` GUID
`SqmSid` SID
`SqmWindowsSessionId` UInt32
`SqmSessionFlags` UInt32

Event ID 4: task_04

Channel: Operational

Fields #

Name	Description
`SqmType` UInt32
`SqmSessionGuid` GUID

Event ID 5: task_05

Channel: Operational

Fields #

Name	Description
`SqmType` UInt32
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 6: task_0Stop

Channel: Operational
Opcode: Stop

Fields #

Name	Description
`SqmType` UInt32
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 7: task_07

Channel: Operational

Fields #

Name	Description
`SqmType` UInt32
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 8: task_08

Channel: Operational

Fields #

Name	Description
`SqmType` UInt32
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 9: task_09

Channel: Operational

Fields #

Name	Description
`SqmType` UInt32
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 10: task_010

Channel: Operational

Fields #

Name	Description
`SqmType` UInt32
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmStringDatapointValue` UnicodeString

Event ID 11: task_011

Channel: Operational

Fields #

Name	Description
`SqmType` UInt32
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmStreamRowLength` UInt32
`SqmStreamRow` Int16

Event ID 16: task_016

Channel: Operational

Fields #

Name	Description
`SqmType` UInt32
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmProcessHashValue` UInt32
`SqmDWORD64DatapointValue` UInt64

Event ID 17: task_017

Channel: Operational

Fields #

Name	Description
`SqmType` UInt32
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmProcessHashValue` UInt32
`SqmStreamRowLength` UInt32
`SqmStreamEntriesSize` UInt32
`SqmStreamEntries` Binary
`SqmStreamFlags` UInt32

Provenance

ETW provider GUID 494e7a3d-8db9-4ec4-b43e-2844af6e38d6

Defined in exfat.sys, the binary that emits these events.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.4893, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB