detection.wiki

Microsoft-Windows-Hotpatch-Monitor

EventTitleChannelSampleRule
106[RealTime][Info] Event with EventName: EventName and EventProperties:OperationalNN
106[RealTime][Info] Event with EventName: EventName and EventProperties: …SystemNN
107[RealTime][Error] Event with EventName: EventName and EventProperties:OperationalNN
107[RealTime][Error] Event with EventName: EventName and EventProperties: …SystemNN
108[AutoLogger][Info] Event with EventName: EventName and EventProperties:OperationalNN
108[AutoLogger][Info] Event with EventName: EventName and EventProperties: …SystemNN
109[AutoLogger][Error] Event with EventName: EventName and EventProperties:OperationalNN
109[AutoLogger][Error] Event with EventName: EventName and EventProperties: …SystemNN

Event ID 106: [RealTime][Info] Event with EventName: EventName and EventProperties:

#
Channel
Operational

Description

[RealTime][Info] Event with EventName: and EventProperties.

Fields #

NameDescription
EventName_Length UInt32
EventName UnicodeString
EventProperties_Length UInt32
EventProperties UnicodeString

Event ID 106: [RealTime][Info] Event with EventName: EventName and EventProperties: EventProperties.

#
Channel
System

Message #

[RealTime][Info] Event with EventName: %2 and EventProperties: %4

Fields #

NameDescription
EventName_Length UInt32
EventName UnicodeString
EventProperties_Length UInt32
EventProperties UnicodeString

Event ID 107: [RealTime][Error] Event with EventName: EventName and EventProperties:

#
Channel
Operational

Description

[RealTime][Error] Event with EventName: and EventProperties.

Fields #

NameDescription
EventName_Length UInt32
EventName UnicodeString
EventProperties_Length UInt32
EventProperties UnicodeString

Event ID 107: [RealTime][Error] Event with EventName: EventName and EventProperties: EventProperties.

#
Channel
System

Message #

[RealTime][Error] Event with EventName: %2 and EventProperties: %4

Fields #

NameDescription
EventName_Length UInt32
EventName UnicodeString
EventProperties_Length UInt32
EventProperties UnicodeString

Event ID 108: [AutoLogger][Info] Event with EventName: EventName and EventProperties:

#
Channel
Operational

Description

[AutoLogger][Info] Event with EventName: and EventProperties.

Fields #

NameDescription
EventName_Length UInt32
EventName UnicodeString
EventProperties_Length UInt32
EventProperties UnicodeString

Event ID 108: [AutoLogger][Info] Event with EventName: EventName and EventProperties: EventProperties.

#
Channel
System

Message #

[AutoLogger][Info] Event with EventName: %2 and EventProperties: %4

Fields #

NameDescription
EventName_Length UInt32
EventName UnicodeString
EventProperties_Length UInt32
EventProperties UnicodeString

Event ID 109: [AutoLogger][Error] Event with EventName: EventName and EventProperties:

#
Channel
Operational

Description

[AutoLogger][Error] Event with EventName: and EventProperties.

Fields #

NameDescription
EventName_Length UInt32
EventName UnicodeString
EventProperties_Length UInt32
EventProperties UnicodeString

Event ID 109: [AutoLogger][Error] Event with EventName: EventName and EventProperties: EventProperties.

#
Channel
System

Message #

[AutoLogger][Error] Event with EventName: %2 and EventProperties: %4

Fields #

NameDescription
EventName_Length UInt32
EventName UnicodeString
EventProperties_Length UInt32
EventProperties UnicodeString

Provenance

ETW provider GUID 57eaf242-3772-533c-9fd2-29ed95606d14

Defined in hpatchmon.dll, which carries the event manifest.

  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB