detection.wiki

Microsoft-Windows-Kernel-CPU-Partition

EventTitleChannelSampleRule
1An affinitization request (Kernel = KernelAffinitization) for the thread with …AnalyticNN
2A DPC (Pointer = DeferredRoutineAddress) was scheduled on processor …AnalyticNN
3A DPC (Pointer = DeferredRoutineAddress) was scheduled as a generic DPC call, …AnalyticNN

Event ID 1: An affinitization request (Kernel = KernelAffinitization) for the thread with TID ThreadID violated CPU Partitions with the following affinity: RequestedAffinity.

#
Channel
Analytic
Task
CPUPartitionviolation
Opcode
AnaffinitizationrequestviolatedCPUPartitions

Message #

An affinitization request (Kernel = %1) for the thread with TID %2 violated CPU Partitions with the following affinity: %4.

Fields #

NameDescription
KernelAffinitization Boolean
ThreadID UInt32
GroupCount UInt16
RequestedAffinity UInt8

Event ID 2: A DPC (Pointer = DeferredRoutineAddress) was scheduled on processor RequestedProcessorNumber, across CPU Partition reservations.

#
Channel
Analytic
Task
CPUPartitionviolation
Opcode
ADPCschedulingrequestviolatedCPUPartitions

Message #

A DPC (Pointer = %1) was scheduled on processor %2, across CPU Partition reservations.

Fields #

NameDescription
DeferredRoutineAddress Pointer
RequestedProcessorNumber UInt32

Event ID 3: A DPC (Pointer = DeferredRoutineAddress) was scheduled as a generic DPC call, across CPU Partition reservations.

#
Channel
Analytic
Task
CPUPartitionviolation
Opcode
AgenericDPCcallrequestviolatedCPUPartitions

Message #

A DPC (Pointer = %1) was scheduled as a generic DPC call, across CPU Partition reservations.

Fields #

NameDescription
DeferredRoutineAddress Pointer

Provenance

ETW provider GUID 3a493674-937f-5a23-f598-d56b9bd10d28

Defined in Microsoft-Windows-System-Events.dll, which carries the event manifest.

  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB