detection.wiki

Microsoft-Windows-IPNAT

EventTitleChannelSampleRule
2001_DebugString.DiagnosticNN

Event ID 2001: _DebugString.

#
Channel
Diagnostic
Task
DebugTrace
Opcode
DebugTrace

Message #

%1

Fields #

NameDescription
_DebugString AnsiString

Provenance

ETW provider GUID a67075c2-3e39-4109-b6cd-6d750058a732

Defined in ipnat.sys, the binary that emits these events.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4202, captured 2026-06-02 — Manifest XML pack, 2.0 MB