Microsoft-Windows-Hyper-V-Debug

22 events across 3 channels

Event	Title	Channel	Sample
1500	[Virtual machine VmId]	Operational	N
1500	[Virtual machine VmId] TraceData.	Microsoft-Windows-Hyper-V-Worker-Analytic	N
1510	[Virtual machine VmId]	Operational	N
1510	[Virtual machine VmId] TraceData.	Microsoft-Windows-Hyper-V-Worker-Analytic	N
1520	[Virtual machine VmId]	Operational	N
1520	[Virtual machine VmId] TraceData.	Microsoft-Windows-Hyper-V-Worker-Analytic	N
1530	[Virtual machine VmId]	Operational	N
1530	[Virtual machine VmId] TraceData.	Microsoft-Windows-Hyper-V-Worker-Analytic	N
23015	Virtual machine 'VmName' cannot assign the UDP port Parameter0 to the synthetic …	Operational	N
23015	Virtual machine 'VmName' cannot assign the UDP port Parameter0 to the synthetic …	Microsoft-Windows-Hyper-V-Worker-Admin	N
23016	Virtual machine 'VmName' cannot assign the UDP port Parameter0 to the synthetic …	Operational	N
23016	Virtual machine 'VmName' cannot assign the UDP port Parameter0 to the synthetic …	Microsoft-Windows-Hyper-V-Worker-Admin	N
23017	Virtual machine 'VmName' the synthetic debug device DebugPortEnabled value …	Operational	N
23017	Virtual machine 'VmName' the synthetic debug device DebugPortEnabled value …	Microsoft-Windows-Hyper-V-Worker-Admin	N
23018	Virtual machine 'VmName' the synthetic debug device failed to configure the UDP …	Operational	N
23018	Virtual machine 'VmName' the synthetic debug device failed to configure the UDP …	Microsoft-Windows-Hyper-V-Worker-Admin	N
23019	Virtual machine 'VmName' the synthetic debug device failed to write to the …	Operational	N
23019	Virtual machine 'VmName' the synthetic debug device failed to write to the …	Microsoft-Windows-Hyper-V-Worker-Admin	N
23020	The virtual machine VmName cannot load device Device because there are no …	Operational	N
23020	The virtual machine VmName cannot load device Device because there are no …	Microsoft-Windows-Hyper-V-Worker-Admin	N
23021	The device Device cannot be loaded because there are no mutually support …	Operational	N
23021	The device Device cannot be loaded because there are no mutually support …	Microsoft-Windows-Hyper-V-Worker-Admin	N

Event ID 1500: [Virtual machine VmId]

Provider: Microsoft-Windows-Hyper-V-Debug
Channel: Operational

Description

[Virtual machine ].

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 1500: [Virtual machine VmId] TraceData.

Provider: Microsoft-Windows-Hyper-V-Debug
Channel: Microsoft-Windows-Hyper-V-Worker-Analytic

Description

[Virtual machine VmId] TraceData.

Message #

[Virtual machine %3] %1

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 1510: [Virtual machine VmId]

Provider: Microsoft-Windows-Hyper-V-Debug
Channel: Operational

Description

[Virtual machine ].

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 1510: [Virtual machine VmId] TraceData.

Provider: Microsoft-Windows-Hyper-V-Debug
Channel: Microsoft-Windows-Hyper-V-Worker-Analytic

Description

[Virtual machine VmId] TraceData.

Message #

[Virtual machine %3] %1

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 1520: [Virtual machine VmId]

Provider: Microsoft-Windows-Hyper-V-Debug
Channel: Operational

Description

[Virtual machine ].

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 1520: [Virtual machine VmId] TraceData.

Provider: Microsoft-Windows-Hyper-V-Debug
Channel: Microsoft-Windows-Hyper-V-Worker-Analytic

Description

[Virtual machine VmId] TraceData.

Message #

[Virtual machine %3] %1

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 1530: [Virtual machine VmId]

Provider: Microsoft-Windows-Hyper-V-Debug
Channel: Operational

Description

[Virtual machine ].

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 1530: [Virtual machine VmId] TraceData.

Provider: Microsoft-Windows-Hyper-V-Debug
Channel: Microsoft-Windows-Hyper-V-Worker-Analytic

Description

[Virtual machine VmId] TraceData.

Message #

[Virtual machine %3] %1

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 23015: Virtual machine 'VmName' cannot assign the UDP port Parameter0 to the synthetic debug device because is in use by another program

Provider: Microsoft-Windows-Hyper-V-Debug
Channel: Operational

Description

Virtual machine 'VmName' cannot assign the UDP port Parameter0 to the synthetic debug device because is in use by another program.

Fields #

Name	Description
`VmName` UnicodeString
`Parameter0` Int16

Event ID 23015: Virtual machine 'VmName' cannot assign the UDP port Parameter0 to the synthetic debug device because is in use by another program.

Provider: Microsoft-Windows-Hyper-V-Debug
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

Virtual machine 'VmName' cannot assign the UDP port Parameter0 to the synthetic debug device because is in use by another program.

Message #

Virtual machine '%1' cannot assign the UDP port %2 to the synthetic debug device because is in use by another program.

Fields #

Name	Description
`VmName` UnicodeString
`Parameter0` Int16

Event ID 23016: Virtual machine 'VmName' cannot assign the UDP port Parameter0 to the synthetic debug device because is not a valid port

Provider: Microsoft-Windows-Hyper-V-Debug
Channel: Operational

Description

Virtual machine 'VmName' cannot assign the UDP port Parameter0 to the synthetic debug device because is not a valid port.

Fields #

Name	Description
`VmName` UnicodeString
`Parameter0` Int64

Event ID 23016: Virtual machine 'VmName' cannot assign the UDP port Parameter0 to the synthetic debug device because is not a valid port.

Provider: Microsoft-Windows-Hyper-V-Debug
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

Virtual machine 'VmName' cannot assign the UDP port Parameter0 to the synthetic debug device because is not a valid port.

Message #

Virtual machine '%1' cannot assign the UDP port %2 to the synthetic debug device because is not a valid port.

Fields #

Name	Description
`VmName` UnicodeString
`Parameter0` Int64

Event ID 23017: Virtual machine 'VmName' the synthetic debug device DebugPortEnabled value Parameter0 is not valid

Provider: Microsoft-Windows-Hyper-V-Debug
Channel: Operational

Description

Virtual machine 'VmName' the synthetic debug device DebugPortEnabled value Parameter0 is not valid.

Fields #

Name	Description
`VmName` UnicodeString
`Parameter0` Int64

Event ID 23017: Virtual machine 'VmName' the synthetic debug device DebugPortEnabled value Parameter0 is not valid.

Provider: Microsoft-Windows-Hyper-V-Debug
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

Virtual machine 'VmName' the synthetic debug device DebugPortEnabled value Parameter0 is not valid.

Message #

Virtual machine '%1' the synthetic debug device DebugPortEnabled value %2 is not valid.

Fields #

Name	Description
`VmName` UnicodeString
`Parameter0` Int64

Event ID 23018: Virtual machine 'VmName' the synthetic debug device failed to configure the UDP port

Provider: Microsoft-Windows-Hyper-V-Debug
Channel: Operational

Description

Virtual machine 'VmName' the synthetic debug device failed to configure the UDP port. Error Parameter0.

Fields #

Name	Description
`VmName` UnicodeString
`Parameter0` Int32

Event ID 23018: Virtual machine 'VmName' the synthetic debug device failed to configure the UDP port.

Provider: Microsoft-Windows-Hyper-V-Debug
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

Virtual machine 'VmName' the synthetic debug device failed to configure the UDP port. Error Parameter0.

Message #

Virtual machine '%1' the synthetic debug device failed to configure the UDP port. Error %2.

Fields #

Name	Description
`VmName` UnicodeString
`Parameter0` Int32

Event ID 23019: Virtual machine 'VmName' the synthetic debug device failed to write to the repository

Provider: Microsoft-Windows-Hyper-V-Debug
Channel: Operational

Description

Virtual machine 'VmName' the synthetic debug device failed to write to the repository. Error Parameter0.

Fields #

Name	Description
`VmName` UnicodeString
`Parameter0` Int32

Event ID 23019: Virtual machine 'VmName' the synthetic debug device failed to write to the repository.

Provider: Microsoft-Windows-Hyper-V-Debug
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

Virtual machine 'VmName' the synthetic debug device failed to write to the repository. Error Parameter0.

Message #

Virtual machine '%1' the synthetic debug device failed to write to the repository. Error %2.

Fields #

Name	Description
`VmName` UnicodeString
`Parameter0` Int32

Event ID 23020: The virtual machine VmName cannot load device Device because there are no mutually supported protocol versions

Provider: Microsoft-Windows-Hyper-V-Debug
Channel: Operational

Description

The virtual machine cannot load device because there are no mutually supported protocol versions. The server version is and the client version is (Virtual machine ID ).

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Device` UnicodeString
`ServerVersion` UnicodeString
`ClientVersion` UnicodeString

Event ID 23020: The virtual machine VmName cannot load device Device because there are no mutually supported protocol versions.

Provider: Microsoft-Windows-Hyper-V-Debug
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

The virtual machine VmName cannot load device Device because there are no mutually supported protocol versions. The server version is ServerVersion and the client version is ClientVersion (Virtual machine ID VmId).

Message #

The virtual machine %1 cannot load device %3 because there are no mutually supported protocol versions. The server version is %4 and the client version is %5 (Virtual machine ID %2).

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Device` UnicodeString
`ServerVersion` UnicodeString
`ClientVersion` UnicodeString

Event ID 23021: The device Device cannot be loaded because there are no mutually support protocol versions between the server and client

Provider: Microsoft-Windows-Hyper-V-Debug
Channel: Operational

Description

The device cannot be loaded because there are no mutually support protocol versions between the server and client.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Device` UnicodeString
`ServerVersion` UnicodeString
`ClientVersion` UnicodeString

Event ID 23021: The device Device cannot be loaded because there are no mutually support protocol versions between the server and client.

Provider: Microsoft-Windows-Hyper-V-Debug
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

The device Device cannot be loaded because there are no mutually support protocol versions between the server and client.

Message #

The device %3 cannot be loaded because there are no mutually support protocol versions between the server and client.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Device` UnicodeString
`ServerVersion` UnicodeString
`ClientVersion` UnicodeString

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID eded5085-79d0-4e31-9b4e-4299b78cbeeb

Defined in vmdebug.dll, which carries the event manifest.

Observed on:

Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

Downloads

Microsoft-Windows-Hyper-V-Debug registered manifest XML (in the Win11-26200.6584 manifest pack, 2.0 MB) manifest-xml

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)