detection.wiki

Microsoft-Windows-Graphics-Capture-Server

EventTitleChannelSampleRule
1CAPTURE_STARTEDOperationalNN
2CAPTURE_STOPPEDOperationalNN

Event ID 1: CAPTURE_STARTED

#
Channel
Operational
Task
CAPTURE_STARTED

Fields #

NameDescription
processId UInt32

Event ID 2: CAPTURE_STOPPED

#
Channel
Operational
Task
CAPTURE_STOPPED

Fields #

NameDescription
processId UInt32

Provenance

ETW provider GUID 7d0cbd25-390e-524d-8c1e-2a8e846055c0

Defined in CaptureService.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB