detection.wiki

Microsoft-Windows-IE-SmartScreen

EventTitleChannelSampleRule
1CacheCheckMicrosoft-Windows-IE-SmartScreenNN
2CacheCheckMicrosoft-Windows-IE-SmartScreenNN
3DatCheckMicrosoft-Windows-IE-SmartScreenNN
4DatCheckMicrosoft-Windows-IE-SmartScreenNN
5URSCallMicrosoft-Windows-IE-SmartScreenNN
6URSCallMicrosoft-Windows-IE-SmartScreenNN
7TelemetryCheckMicrosoft-Windows-IE-SmartScreenNN
8TelemetryCheckMicrosoft-Windows-IE-SmartScreenNN
9CacheCheckMicrosoft-Windows-IE-SmartScreenNN
10DatCheckMicrosoft-Windows-IE-SmartScreenNN
11URSCallMicrosoft-Windows-IE-SmartScreenNN
12URSCallMicrosoft-Windows-IE-SmartScreenNN
13URSCallMicrosoft-Windows-IE-SmartScreenNN
14URSCallMicrosoft-Windows-IE-SmartScreenNN
15TelemetryCheckMicrosoft-Windows-IE-SmartScreenNN
16TelemetryCheckMicrosoft-Windows-IE-SmartScreenNN
17TelemetryCheckMicrosoft-Windows-IE-SmartScreenNN
18URLReputationCheckMicrosoft-Windows-IE-SmartScreenNN
19URLReputationCheckMicrosoft-Windows-IE-SmartScreenNN
20URLReputationCheckMicrosoft-Windows-IE-SmartScreenNN
21URLReputationCheckMicrosoft-Windows-IE-SmartScreenNN
22URLReputationCheckMicrosoft-Windows-IE-SmartScreenNN
23URSCallMicrosoft-Windows-IE-SmartScreenNN
24URSCallMicrosoft-Windows-IE-SmartScreenNN
25URSCallMicrosoft-Windows-IE-SmartScreenNN
26URSCallMicrosoft-Windows-IE-SmartScreenNN
27TelemetryCheckMicrosoft-Windows-IE-SmartScreenNN
28TelemetryCheckMicrosoft-Windows-IE-SmartScreenNN
29TelemetryCheckMicrosoft-Windows-IE-SmartScreenNN
30TelemetryCheckMicrosoft-Windows-IE-SmartScreenNN
31URLReputationCheckMicrosoft-Windows-IE-SmartScreenNN
32URLReputationCheckMicrosoft-Windows-IE-SmartScreenNN
33FeedbackCallMicrosoft-Windows-IE-SmartScreenNN
34TelemetryCheckMicrosoft-Windows-IE-SmartScreenNN
1100task_0Microsoft-Windows-IE-SmartScreenNN

Event ID 1: CacheCheck

#
Channel
Microsoft-Windows-IE-SmartScreen
Task
CacheCheck
Opcode
Start

Fields #

NameDescription
URL UnicodeString

Event ID 2: CacheCheck

#
Channel
Microsoft-Windows-IE-SmartScreen
Task
CacheCheck
Opcode
Stop

Fields #

NameDescription
URL UnicodeString

Event ID 3: DatCheck

#
Channel
Microsoft-Windows-IE-SmartScreen
Task
DatCheck
Opcode
Start

Fields #

NameDescription
URL UnicodeString

Event ID 4: DatCheck

#
Channel
Microsoft-Windows-IE-SmartScreen
Task
DatCheck
Opcode
Stop

Fields #

NameDescription
URL UnicodeString

Event ID 5: URSCall

#
Channel
Microsoft-Windows-IE-SmartScreen
Task
URSCall
Opcode
Start

Fields #

NameDescription
ReqType UInt32

Event ID 6: URSCall

#
Channel
Microsoft-Windows-IE-SmartScreen
Task
URSCall
Opcode
Stop

Fields #

NameDescription
ReqType UInt32

Event ID 7: TelemetryCheck

#
Channel
Microsoft-Windows-IE-SmartScreen
Task
TelemetryCheck
Opcode
Start

Fields #

NameDescription
ReqType UInt32

Event ID 8: TelemetryCheck

#
Channel
Microsoft-Windows-IE-SmartScreen
Task
TelemetryCheck
Opcode
Stop

Fields #

NameDescription
ReqType UInt32

Event ID 9: CacheCheck

#
Channel
Microsoft-Windows-IE-SmartScreen
Task
CacheCheck

Fields #

NameDescription
URL UnicodeString
CacheExist Boolean

Event ID 10: DatCheck

#
Channel
Microsoft-Windows-IE-SmartScreen
Task
DatCheck

Fields #

NameDescription
URL UnicodeString
DatExist Boolean

Event ID 11: URSCall

#
Channel
Microsoft-Windows-IE-SmartScreen
Task
URSCall

Fields #

NameDescription
numElements UInt32
DefaultLangId UnicodeString
lastOverrideToken UnicodeString
newOverrideToken UnicodeString

Event ID 12: URSCall

#
Channel
Microsoft-Windows-IE-SmartScreen
Task
URSCall

Fields #

NameDescription
URL UnicodeString
RawURL UnicodeString
UrlType UnicodeString
ReqType UnicodeString
HostIP UnicodeString

Event ID 13: URSCall

#
Channel
Microsoft-Windows-IE-SmartScreen
Task
URSCall

Fields #

NameDescription
URL UnicodeString
RawURL UnicodeString
UrlType UnicodeString
ReqType UnicodeString
HostIP UnicodeString

Event ID 14: URSCall

#
Channel
Microsoft-Windows-IE-SmartScreen
Task
URSCall

Fields #

NameDescription
URL UnicodeString
Categories UnicodeString
HC UInt32
PC UInt32

Event ID 15: TelemetryCheck

#
Channel
Microsoft-Windows-IE-SmartScreen
Task
TelemetryCheck

Fields #

NameDescription
GUID UnicodeString
DV UnicodeString
FV UnicodeString
OSV UnicodeString
BrowserLang UnicodeString
ReportType UnicodeString
ClientID UnicodeString
TopURL UnicodeString
RawTopURL UnicodeString
TopReferURL UnicodeString
RawTopReferURL UnicodeString
HostIP UnicodeString
Threats UnicodeString
FramesCount UInt32
WhyString UnicodeString

Event ID 16: TelemetryCheck

#
Channel
Microsoft-Windows-IE-SmartScreen
Task
TelemetryCheck

Fields #

NameDescription
FrameURL UnicodeString
RawFrameURL UnicodeString
FramePCL UnicodeString
FrameTricks UnicodeString
Framekeywords UnicodeString
FrameUrlType UnicodeString
FrameIP UnicodeString
Signature UnicodeString

Event ID 17: TelemetryCheck

#
Channel
Microsoft-Windows-IE-SmartScreen
Task
TelemetryCheck

Fields #

NameDescription
FrameURL UnicodeString
RawFrameURL UnicodeString
FramePCL UnicodeString
FrameTricks UnicodeString
Framekeywords UnicodeString
FrameUrlType UnicodeString
FrameIP UnicodeString
Signature UnicodeString

Event ID 18: URLReputationCheck

#
Channel
Microsoft-Windows-IE-SmartScreen
Task
URLReputationCheck

Fields #

NameDescription
URL UnicodeString
Categories UnicodeString
HC UInt32
PC UInt32

Event ID 19: URLReputationCheck

#
Channel
Microsoft-Windows-IE-SmartScreen
Task
URLReputationCheck

Fields #

NameDescription
URL UnicodeString
PCL Double
THREAT UInt32
Heuristic UnicodeString

Event ID 20: URLReputationCheck

#
Channel
Microsoft-Windows-IE-SmartScreen
Task
URLReputationCheck

Fields #

NameDescription
URL UnicodeString
PCL Double
THREAT UInt32
Heuristic UnicodeString
HasAnyInputFields Boolean
HasPasswordField Boolean

Event ID 21: URLReputationCheck

#
Channel
Microsoft-Windows-IE-SmartScreen
Task
URLReputationCheck

Fields #

NameDescription
URL UnicodeString
LinksCount UInt32
TopTargetCount UInt32

Event ID 22: URLReputationCheck

#
Channel
Microsoft-Windows-IE-SmartScreen
Task
URLReputationCheck

Fields #

NameDescription
URL UnicodeString
CanonURL UnicodeString

Event ID 23: URSCall

#
Channel
Microsoft-Windows-IE-SmartScreen
Task
URSCall

Fields #

NameDescription
Info UnicodeString
XML UnicodeString

Event ID 24: URSCall

#
Channel
Microsoft-Windows-IE-SmartScreen
Task
URSCall

Fields #

NameDescription
Info UnicodeString
XML UnicodeString

Event ID 25: URSCall

#
Channel
Microsoft-Windows-IE-SmartScreen
Task
URSCall

Fields #

NameDescription
Info UnicodeString
XML UnicodeString

Event ID 26: URSCall

#
Channel
Microsoft-Windows-IE-SmartScreen
Task
URSCall

Fields #

NameDescription
Info UnicodeString
XML UnicodeString

Event ID 27: TelemetryCheck

#
Channel
Microsoft-Windows-IE-SmartScreen
Task
TelemetryCheck

Fields #

NameDescription
Info UnicodeString
XML UnicodeString

Event ID 28: TelemetryCheck

#
Channel
Microsoft-Windows-IE-SmartScreen
Task
TelemetryCheck

Fields #

NameDescription
Info UnicodeString
XML UnicodeString

Event ID 29: TelemetryCheck

#
Channel
Microsoft-Windows-IE-SmartScreen
Task
TelemetryCheck

Fields #

NameDescription
Info UnicodeString
XML UnicodeString

Event ID 30: TelemetryCheck

#
Channel
Microsoft-Windows-IE-SmartScreen
Task
TelemetryCheck

Fields #

NameDescription
Info UnicodeString
XML UnicodeString

Event ID 31: URLReputationCheck

#
Channel
Microsoft-Windows-IE-SmartScreen
Task
URLReputationCheck

Fields #

NameDescription
URL UnicodeString
FinalHRESULT UInt32
THREAT UInt32
UrsStatus UInt32
AllUrlsFoundInDat Boolean
BlockedUrl UnicodeString
IsBlockedUrlTopFrame Boolean
BlockedUrlCategories UInt64
UrlFetchState UnicodeString

Event ID 32: URLReputationCheck

#
Channel
Microsoft-Windows-IE-SmartScreen
Task
URLReputationCheck

Fields #

NameDescription
Info UnicodeString
URL UnicodeString

Event ID 33: FeedbackCall

#
Channel
Microsoft-Windows-IE-SmartScreen
Task
FeedbackCall

Fields #

NameDescription
Info UnicodeString
XML UnicodeString

Event ID 34: TelemetryCheck

#
Channel
Microsoft-Windows-IE-SmartScreen
Task
TelemetryCheck

Fields #

NameDescription
FrameURL UnicodeString
ScriptSource UnicodeString

Event ID 1100: task_0

#
Channel
Microsoft-Windows-IE-SmartScreen
Opcode
Info

Fields #

NameDescription
Uri UnicodeString
ReferrerUri UnicodeString
RedirectUri UnicodeString
CallingProcessId UInt32Process ID of the process initiating the operation.
CallingProcessCreationTime UInt64
RequestId UnicodeString
FinalResult UnicodeString

Provenance

ETW provider GUID 52f82079-1974-4c67-81da-807b892778bb

Defined in ieapfltr.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 11.00.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 11.00.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB