Microsoft-Windows-IME-Broker
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1 | IMJP Enter Learning | Analytic | N | N |
| 2 | IMJP Leave Learning | Analytic | N | N |
| 3 | IMJP Learning Start | Analytic | N | N |
| 4 | IMJP Learning End | Analytic | N | N |
Event ID 1: IMJP Enter Learning
#Event ID 2: IMJP Leave Learning
#Event ID 3: IMJP Learning Start
#Event ID 4: IMJP Learning End
#Provenance
ETW provider GUID e2c15fd7-8924-4c8c-8cfe-da0be539ce27
Defined in imebroker.exe, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.4294, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB