detection.wiki

Microsoft-Windows-Feedback-Service-TriggerProvider

EventTitleChannelSampleRule
0Windows Error Reporting service has been triggered.Microsoft-Windows-Feedback-Service-TriggerProviderNN

Event ID 0: Windows Error Reporting service has been triggered.

#
Channel
Microsoft-Windows-Feedback-Service-TriggerProvider
Task
StartTrigger

Provenance

ETW provider GUID e46eead8-0c54-4489-9898-8fa79d059e0e

Defined in wersvc.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB