detection.wiki

Microsoft-Windows-GPIOButtons

EventTitleChannelSampleRule
1ConvertibleStateOperationalNN
2DockStateOperationalNN

Event ID 1: ConvertibleState

#
Channel
Operational
Task
ConvertibleState

Fields #

NameDescription
ConvertibleState UInt32

Event ID 2: DockState

#
Channel
Operational
Task
DockState

Fields #

NameDescription
DockState UInt32

Provenance

ETW provider GUID e13ff11e-e989-4838-a9fa-38a4d13914cf

Defined in msgpiowin32.sys, the binary that emits these events.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1150, captured 2026-06-02 — Manifest XML pack, 2.0 MB