Microsoft-Windows-IdCtrls

33 events across 2 channels

Event	Title	Channel	Sample
5001	Cannot navigate to a non SSL URL - URL.	Operational	N
5002	Invalid web page on document complete from URL.	Operational	N
5003	Failed to navigate on URL for TargetFrameName TargetFrameName.	Operational	N
5004	Blocked a popup window from URL for ReferrerUrl ReferrerUrl.	Operational	N
5005	Failed to navigate on wizard ID WizardID through URL - URL.	Operational	N
5006	Failed to execute [Method].	Operational	N
5007	Failed to execute [Method] for [String].	Operational	N
5008	Failed to invoke command in host for DISPID DISPID on parameter ArgErr.	Operational	N
5009	Failed to navigate due to security problem SecurityProblem.	Operational	N
5010	Failed to Get alternative URL for Wizard ID WizardID.	Operational	N
5011	Security manager handle URL URL action Action as policy Policy.	Operational	N
5012	Security manager allow ActiveX control for CLSID CLSID.	Operational	N
5013	Security manager disallow ActiveX control for CLSID CLSID.	Operational	N
5014	QueryCustomPolicy(ObjectSafety) default action for CLSID CLSID.	Operational	N
5015	QueryCustomPolicy(ObjectSafety) disallowed for CLSID CLSID.	Operational	N
5016	QueryCustomPolicy(ObjectSafety) default action for GUID CLSID.	Operational	N
5017	Before navigate to URL.	Operational	N
5018	Navigate completed on URL.	Operational	N
5019	Document completed on URL.	Operational	N
5020	Navigate Redirected to URL.	Operational	N
5021	Window resized to cx: cx, cy: cy.	Operational	N
5022	Succeeded on executing [Method].	Operational	N
5023	Succeeded on executing [Method] for [String].	Operational	N
5024	Executed [Method] for [String].	Operational	N
5025	Showing browser window	Operational	N
5026	Showing progress window	Operational	N
5027	Failed to execute [Method] for [String].	Operational	N
7001	Perf_IdControl_CreateControlStart	Analytic	N
7002	Perf_IdControl_CreateControlStop	Analytic	N
7003	Perf_IdControl_GetInitialURLStart	Analytic	N
7004	Perf_IdControl_GetInitialURLStop	Analytic	N
7005	Perf_IdControl_NavigateStart	Analytic	N
7006	Perf_IdControl_NavigateStop	Analytic	N

Event ID 5001: Cannot navigate to a non SSL URL - URL.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Description

Cannot navigate to a non SSL URL - URL.

Message #

Cannot navigate to a non SSL URL - %1.

Fields #

Name	Description
`URL` UnicodeString

Event ID 5002: Invalid web page on document complete from URL.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Description

Invalid web page on document complete from URL.

Message #

Invalid web page on document complete from %1.

Fields #

Name	Description
`URL` UnicodeString

Event ID 5003: Failed to navigate on URL for TargetFrameName TargetFrameName.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Description

Failed to navigate on URL for TargetFrameName TargetFrameName. (StatusCode StatusCode).

Message #

Failed to navigate on %1 for TargetFrameName %2. (StatusCode %3)

Fields #

Name	Description
`URL` UnicodeString
`TargetFrameName` UnicodeString
`StatusCode` UInt32	NTSTATUS reference

Event ID 5004: Blocked a popup window from URL for ReferrerUrl ReferrerUrl.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Description

Blocked a popup window from URL for ReferrerUrl ReferrerUrl. (Flags Flags).

Message #

Blocked a popup window from %1 for ReferrerUrl %2. (Flags %3)

Fields #

Name	Description
`URL` UnicodeString
`ReferrerUrl` UnicodeString
`Flags` UInt32

Event ID 5005: Failed to navigate on wizard ID WizardID through URL - URL.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Description

Failed to navigate on wizard ID WizardID through URL - URL. (Result HRESULT).

Message #

Failed to navigate on wizard ID %1 through URL - %2. (Result %3)

Fields #

Name	Description
`WizardID` UInt32
`URL` UnicodeString
`HRESULT` UInt32

Event ID 5006: Failed to execute [Method].

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Description

Failed to execute [Method]. (Result HRESULT).

Message #

Failed to execute [%1]. (Result %2)

Fields #

Name	Description
`Method` UnicodeString
`HRESULT` UInt32

Event ID 5007: Failed to execute [Method] for [String].

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Description

Failed to execute [Method] for [String]. (Result HRESULT).

Message #

Failed to execute [%1] for [%2]. (Result %3)

Fields #

Name	Description
`Method` UnicodeString
`String` UnicodeString
`HRESULT` UInt32

Event ID 5008: Failed to invoke command in host for DISPID DISPID on parameter ArgErr.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Description

Failed to invoke command in host for DISPID DISPID on parameter ArgErr. (Result HRESULT).

Message #

Failed to invoke command in host for DISPID %1 on parameter %2. (Result %3)

Fields #

Name	Description
`DISPID` UInt32
`ArgErr` UInt32
`HRESULT` UInt32

References #

Microsoft Learn https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus

Event ID 5009: Failed to navigate due to security problem SecurityProblem.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Description

Failed to navigate due to security problem SecurityProblem. (Result HRESULT).

Message #

Failed to navigate due to security problem %1. (Result %2)

Fields #

Name	Description
`SecurityProblem` UInt32
`HRESULT` UInt32

References #

Microsoft Learn https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus

Event ID 5010: Failed to Get alternative URL for Wizard ID WizardID.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Description

Failed to Get alternative URL for Wizard ID WizardID. (Result HRESULT).

Message #

Failed to Get alternative URL for Wizard ID %1. (Result %2)

Fields #

Name	Description
`WizardID` UInt32
`HRESULT` UInt32

References #

Microsoft Learn https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus

Event ID 5011: Security manager handle URL URL action Action as policy Policy.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Description

Security manager handle URL URL action Action as policy Policy. (Result HRESULT).

Message #

Security manager handle URL %1 action %2 as policy %3. (Result %4)

Fields #

Name	Description
`URL` UnicodeString
`Action` UInt32
`Policy` UInt32
`HRESULT` UInt32

References #

Microsoft Learn https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus

Event ID 5012: Security manager allow ActiveX control for CLSID CLSID.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Description

Security manager allow ActiveX control for CLSID CLSID. (URL URL).

Message #

Security manager allow ActiveX control for CLSID %1. (URL %2)

Fields #

Name	Description
`CLSID` GUID
`URL` UnicodeString

References #

Microsoft Learn https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus

Event ID 5013: Security manager disallow ActiveX control for CLSID CLSID.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Description

Security manager disallow ActiveX control for CLSID CLSID. (URL URL).

Message #

Security manager disallow ActiveX control for CLSID %1. (URL %2)

Fields #

Name	Description
`CLSID` GUID
`URL` UnicodeString

References #

Microsoft Learn https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus

Event ID 5014: QueryCustomPolicy(ObjectSafety) default action for CLSID CLSID.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Description

QueryCustomPolicy(ObjectSafety) default action for CLSID CLSID. (URL URL).

Message #

QueryCustomPolicy(ObjectSafety) default action for CLSID %1. (URL %2)

Fields #

Name	Description
`CLSID` GUID
`URL` UnicodeString

Event ID 5015: QueryCustomPolicy(ObjectSafety) disallowed for CLSID CLSID.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Description

QueryCustomPolicy(ObjectSafety) disallowed for CLSID CLSID. (URL URL).

Message #

QueryCustomPolicy(ObjectSafety) disallowed for CLSID %1. (URL %2)

Fields #

Name	Description
`CLSID` GUID
`URL` UnicodeString

Event ID 5016: QueryCustomPolicy(ObjectSafety) default action for GUID CLSID.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Description

QueryCustomPolicy(ObjectSafety) default action for GUID CLSID. (URL URL).

Message #

QueryCustomPolicy(ObjectSafety) default action for GUID %1. (URL %2)

Fields #

Name	Description
`CLSID` GUID
`URL` UnicodeString

Event ID 5017: Before navigate to URL.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Description

Before navigate to URL.

Message #

Before navigate to %1.

Fields #

Name	Description
`URL` UnicodeString

Event ID 5018: Navigate completed on URL.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Description

Navigate completed on URL.

Message #

Navigate completed on %1.

Fields #

Name	Description
`URL` UnicodeString

Event ID 5019: Document completed on URL.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Description

Document completed on URL.

Message #

Document completed on %1.

Fields #

Name	Description
`URL` UnicodeString

Event ID 5020: Navigate Redirected to URL.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Description

Navigate Redirected to URL.

Message #

Navigate Redirected to %1.

Fields #

Name	Description
`URL` UnicodeString

Event ID 5021: Window resized to cx: cx, cy: cy.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Description

Window resized to cx: cx, cy: cy.

Message #

Window resized to cx: %1, cy: %2.

Fields #

Name	Description
`cx` UInt32
`cy` UInt32

Event ID 5022: Succeeded on executing [Method].

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Description

Succeeded on executing [Method].

Message #

Succeeded on executing [%1].

Fields #

Name	Description
`Method` UnicodeString

Event ID 5023: Succeeded on executing [Method] for [String].

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Description

Succeeded on executing [Method] for [String].

Message #

Succeeded on executing [%1] for [%2].

Fields #

Name	Description
`Method` UnicodeString
`String` UnicodeString

Event ID 5024: Executed [Method] for [String].

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Description

Executed [Method] for [String]. (Result HRESULT).

Message #

Executed [%1] for [%2]. (Result %3)

Fields #

Name	Description
`Method` UnicodeString
`String` UnicodeString
`HRESULT` UInt32

Event ID 5025: Showing browser window

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Description

Showing browser window.

Message #

Showing browser window

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5025
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5025

Event ID 5026: Showing progress window

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Description

Showing progress window.

Message #

Showing progress window

Event ID 5027: Failed to execute [Method] for [String].

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Description

Failed to execute [Method] for [String]. Extended error text: Extended String. (Result HRESULT).

Message #

Failed to execute [%1] for [%2]. Extended error text: %3. (Result %4)

Fields #

Name	Description
`Method` UnicodeString
`String` UnicodeString
`ExtendedString` UnicodeString
`HRESULT` UInt32

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5027
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5027

Event ID 7001: Perf_IdControl_CreateControlStart

Provider: Microsoft-Windows-IdCtrls
Channel: Analytic
Task: Perf_IdControl_CreateControl
Opcode: Start

Event ID 7002: Perf_IdControl_CreateControlStop

Provider: Microsoft-Windows-IdCtrls
Channel: Analytic
Task: Perf_IdControl_CreateControl
Opcode: Stop

Event ID 7003: Perf_IdControl_GetInitialURLStart

Provider: Microsoft-Windows-IdCtrls
Channel: Analytic
Task: Perf_IdControl_GetInitialURL
Opcode: Start

Event ID 7004: Perf_IdControl_GetInitialURLStop

Provider: Microsoft-Windows-IdCtrls
Channel: Analytic
Task: Perf_IdControl_GetInitialURL
Opcode: Stop

Event ID 7005: Perf_IdControl_NavigateStart

Provider: Microsoft-Windows-IdCtrls
Channel: Analytic
Task: Perf_IdControl_Navigate
Opcode: Start

Event ID 7006: Perf_IdControl_NavigateStop

Provider: Microsoft-Windows-IdCtrls
Channel: Analytic
Task: Perf_IdControl_Navigate
Opcode: Stop

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 6d7662a9-034e-4b1f-a167-67819c401632

Defined in IdCtrls.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)