Microsoft-Windows-Kernel-General

24 events across 2 channels

Event	Title	Channel	Sample
1	The system time has changed to NewTime from OldTime.	System	Y
2	License policy-cache corruption detected.	System	N
3	License policy-cache corruption has been fixed.	System	N
4	License policy-cache has expired because it was not updated within expected …	System	N
5	{Registry Hive Recovered} Registry hive (file): 'ExtraString' was corrupted and …	System	Y
6	An I/O operation initiated by the Registry failed unrecoverably.	System	N
7	The system failed to open transaction log {LogFile} for hive {HivePath}.	System	N
11	TxR init phase for hive ExtraString (TM: TmId, RM: RmId) finished with …	System	Y
12	The operating system started at system time StartTime.	System	Y
13	The operating system is shutting down at system time StopTime.	System	Y
14	task_014	Operational	N
15	Hive HiveName was reorganized with a starting size of OriginalSize bytes and an …	System	Y
16	The access history in hive HiveName was cleared updating KeysUpdated keys and …	System	Y
17	task_017	Operational	N
18	The operating system is starting after soft restart.	System	N
19	BootPerformanceData_V3	Operational	N
20	The leap second configuration has been updated.	System	Y
21	Failed to update leap second data from the registry.	System	N
22	The time zone bias has changed to NewBias from OldBias.	System	Y
23	VsmPerformanceData	Operational	N
24	The time zone information was refreshed with exit reason ExitReason.	System	Y
25	The system time was initialized to SystemTime.	System	Y
26	Token information was queried for TokenIsAppContainer	Operational	N
26	Token information was queried for TokenIsAppContainer.	System	N

Event ID 1: The system time has changed to NewTime from OldTime.

Provider: Microsoft-Windows-Kernel-General
Channel: System
Level: Informational
Collection Priority: Recommended (NSA)
Task: SystemTimeChange

Description

The system time has changed to NewTime from OldTime.

Message #

The system time has changed to %1 from %2.

Fields #

Name	Description
`NewTime` FILETIME
`OldTime` FILETIME
`Reason` UInt32	Change Reason.
`ProcessName` UnicodeString
`ProcessID` UInt32
`TimeDeltaInMs` Int64	Time Delta.
`CmosTime` FILETIME	RTC time.
`TimeZoneBias` Int32	Current time zone bias.
`RealTimeIsUniversal` Boolean	RTC time is in UTC.
`SystemInCmosMode` Boolean	System time was based on RTC time.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-General",
    "guid": "{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}",
    "event_source_name": "",
    "event_id": 1,
    "version": 2,
    "level": 4,
    "task": 5,
    "opcode": 0,
    "keywords": -9223372036854775792,
    "time_created": "2026-05-29T23:38:45.9335781+00:00",
    "event_record_id": 6856,
    "correlation": {},
    "execution": {
      "process_id": 5172,
      "thread_id": 5420
    },
    "channel": "System",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "NewTime": "2026-05-29T23:38:45.9329014Z",
    "OldTime": "2026-05-29T23:38:45.9318452Z",
    "Reason": "1",
    "ProcessName": "\\Device\\HarddiskVolume1\\Windows\\System32\\svchost.exe",
    "ProcessID": "5172"
  },
  "message": "The system time has changed to ‎2026‎-‎05‎-‎29T23:38:45.932901400Z from ‎2026‎-‎05‎-‎29T23:38:45.931845200Z.\r\n\r\nChange Reason: An application or system component changed the time.\r\nProcess: '\\Device\\HarddiskVolume1\\Windows\\System32\\svchost.exe' (PID 5172)."
}

Event ID 2: License policy-cache corruption detected.

Provider: Microsoft-Windows-Kernel-General
Channel: System
Opcode: Info

Description

License policy-cache corruption detected.

Message #

License policy-cache corruption detected.

Event ID 3: License policy-cache corruption has been fixed.

Provider: Microsoft-Windows-Kernel-General
Channel: System
Opcode: Info

Description

License policy-cache corruption has been fixed.

Message #

License policy-cache corruption has been fixed.

Event ID 4: License policy-cache has expired because it was not updated within expected duration.

Provider: Microsoft-Windows-Kernel-General
Channel: System
Opcode: Info

Description

License policy-cache has expired because it was not updated within expected duration.

Message #

License policy-cache has expired because it was not updated within expected duration.

Event ID 5: {Registry Hive Recovered} Registry hive (file): 'ExtraString' was corrupted and it has been recovered.

Provider: Microsoft-Windows-Kernel-General
Channel: System
Level: Error
Opcode: Info

Description

{Registry Hive Recovered} Registry hive (file): 'ExtraString' was corrupted and it has been recovered. Some data might have been lost.

Message #

{Registry Hive Recovered} Registry hive (file): '%3' was corrupted and it has been recovered. Some data might have been lost.

Fields #

Name	Description
`FinalStatus` HexInt32
`ExtraStringLength` UInt16
`ExtraString` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-General",
    "guid": "{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}",
    "event_source_name": "",
    "event_id": 5,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-28T11:11:46.4378352+00:00",
    "event_record_id": 1367,
    "correlation": {},
    "execution": {
      "process_id": 636,
      "thread_id": 1044
    },
    "channel": "System",
    "computer": "telemetry-W11-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "FinalStatus": "0x8000002a",
    "ExtraStringLength": "31",
    "ExtraString": "\\SystemRoot\\System32\\Config\\BBI"
  },
  "message": "{Registry Hive Recovered} Registry hive (file): '\\SystemRoot\\System32\\Config\\BBI' was corrupted and it has been recovered. Some data might have been lost."
}

Event ID 6: An I/O operation initiated by the Registry failed unrecoverably.

Provider: Microsoft-Windows-Kernel-General
Channel: System
Opcode: Info

Description

An I/O operation initiated by the Registry failed unrecoverably.The Registry could not flush hive (file): 'ExtraString'.

Message #

An I/O operation initiated by the Registry failed unrecoverably.The Registry could not flush hive (file): '%3'.

Fields #

Name	Description
`FinalStatus` HexInt32
`ExtraStringLength` UInt16
`ExtraString` UnicodeString

Event ID 7: The system failed to open transaction log {LogFile} for hive {HivePath}.

Provider: Microsoft-Windows-Kernel-General
Channel: System

Message #

The system failed to open transaction log {LogFile} for hive {HivePath}. Some transactional consistency might have been lost. (Failure status {Status}; TM: {TmId}; RM: {RmId}; InternalCode: {InternalCode})

Fields #

Name	Description
`LogFile`
`HivePath`
`Status`	NTSTATUS reference
`TmId`
`RmId`
`InternalCode`

Event ID 11: TxR init phase for hive ExtraString (TM: TmId, RM: RmId) finished with result=Status (Internal code=InternalCode).

Provider: Microsoft-Windows-Kernel-General
Channel: System
Level: Informational
Opcode: Info

Description

TxR init phase for hive ExtraString (TM: TmId, RM: RmId) finished with result=Status (Internal code=InternalCode).

Message #

TxR init phase for hive %2 (TM: %3, RM: %4) finished with result=%5 (Internal code=%6).

Fields #

Name	Description
`ExtraStringLength` UInt16
`ExtraString` UnicodeString
`TmId` GUID
`RmId` GUID
`Status` HexInt32	NTSTATUS reference
`InternalCode` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-General",
    "guid": "A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D",
    "event_source_name": "",
    "event_id": 11,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-09T02:31:13.021540+00:00",
    "event_record_id": 2588,
    "correlation": {},
    "execution": {
      "process_id": 4888,
      "thread_id": 1608
    },
    "channel": "System",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ExtraStringLength": 79,
    "ExtraString": "\\??\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy2\\Windows\\System32\\config\\DRIVERS",
    "TmId": "465845D7-1B56-11F1-9FBF-C6B26F270F0B",
    "RmId": "465845D6-1B56-11F1-9FBF-C6B26F270F0B",
    "Status": "0xc00000a2",
    "InternalCode": 7
  },
  "message": ""
}

Event ID 12: The operating system started at system time StartTime.

Provider: Microsoft-Windows-Kernel-General
Channel: System
Level: Informational
Collection Priority: Recommended (Microsoft-WEF, others)
Task: SystemStart

Description

The operating system started at system time StartTime.

Message #

The operating system started at system time %7.

Fields #

Name	Description
`MajorVersion` UInt32
`MinorVersion` UInt32
`BuildVersion` UInt32
`QfeVersion` UInt32
`ServiceVersion` UInt16
`BootMode` UInt32
`StartTime` FILETIME

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-General",
    "guid": "{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}",
    "event_source_name": "",
    "event_id": 12,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": -9223372036854775680,
    "time_created": "2026-05-29T16:32:43.9802317+00:00",
    "event_record_id": 6660,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 8
    },
    "channel": "System",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "MajorVersion": "10",
    "MinorVersion": "0",
    "BuildVersion": "20348",
    "QfeVersion": "587",
    "ServiceVersion": "0",
    "BootMode": "0",
    "StartTime": "2026-05-29T16:32:43.5000000Z"
  },
  "message": "The operating system started at system time ‎2026‎-‎05‎-‎29T16:32:43.500000000Z."
}

References #

Microsoft Learn https://learn.microsoft.com/en-us/troubleshoot/windows-server/performance/troubleshoot-unexpected-reboots-system-event-logs

Event ID 13: The operating system is shutting down at system time StopTime.

Provider: Microsoft-Windows-Kernel-General
Channel: System
Level: Informational
Collection Priority: Recommended (Microsoft-WEF, others)
Task: SystemStop

Description

The operating system is shutting down at system time StopTime.

Message #

The operating system is shutting down at system time %1.

Fields #

Name	Description
`StopTime` FILETIME

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-General",
    "guid": "{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}",
    "event_source_name": "",
    "event_id": 13,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": -9223372036854775680,
    "time_created": "2026-06-13T05:22:40.0809672+00:00",
    "event_record_id": 7416,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 8144
    },
    "channel": "System",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "StopTime": "2026-06-13T05:22:40.0809646Z"
  },
  "message": "The operating system is shutting down at system time ‎2026‎-‎06‎-‎13T05:22:40.080964600Z."
}

References #

Microsoft Learn https://learn.microsoft.com/en-us/troubleshoot/windows-server/performance/troubleshoot-unexpected-reboots-system-event-logs

Event ID 14: task_014

Provider: Microsoft-Windows-Kernel-General
Channel: Operational
Opcode: Info

Fields #

Name	Description
`Mode` UnicodeString
`ObjectType` UnicodeString
`ObjectName` UnicodeString
`ProcessName` UnicodeString
`ObjectCreatorProcessName` UnicodeString
`AccessMask` HexInt32	Access mask reference
`TokenType` UInt32
`ImpersonationLevel` UInt32	Impersonation level (SecurityAnonymous=0, SecurityIdentification=1, SecurityImpersonation=2, SecurityDelegation=3). Known values `%%1831` Anonymous `%%1832` Identification `%%1833` Impersonation `%%1840` Delegation
`SessionId` UInt32
`LowBoxNumber` UInt32
`TokenGroupsCount` UInt32
`TokenGroups` 28
`TokenPackageCount` UInt32
`TokenPackage` 30
`TokenCapabilityCount` UInt32
`TokenCapabilities` 31
`TokenTrustLevelCount` UInt32
`TokenTrustLevel` 33
`SecurityDescriptorRevision` UInt8
`SecurityDescriptorControl` UInt16
`SecurityDescriptorOwner` SID
`SecurityDescriptorGroup` SID
`DaclRevision` UInt8
`DaclAceCount` UInt16
`DaclAce` 34
`SaclRevision` UInt8
`SaclAceCount` UInt16
`SaclAce` 38

Event ID 15: Hive HiveName was reorganized with a starting size of OriginalSize bytes and an ending size of NewSize bytes.

Provider: Microsoft-Windows-Kernel-General
Channel: System
Level: Informational
Task: ReorganizeHive

Description

Hive HiveName was reorganized with a starting size of OriginalSize bytes and an ending size of NewSize bytes.

Message #

Hive %2 was reorganized with a starting size of %3 bytes and an ending size of %4 bytes.

Fields #

Name	Description
`HiveNameLength` UInt16
`HiveName` UnicodeString
`OriginalSize` UInt32
`NewSize` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-General",
    "guid": "{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}",
    "event_source_name": "",
    "event_id": 15,
    "version": 0,
    "level": 4,
    "task": 10,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T05:22:51.6711715+00:00",
    "event_record_id": 7443,
    "correlation": {},
    "execution": {
      "process_id": 172,
      "thread_id": 584
    },
    "channel": "System",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HiveNameLength": "36",
    "HiveName": "\\SystemRoot\\System32\\Config\\SOFTWARE",
    "OriginalSize": "75931648",
    "NewSize": "75091968"
  },
  "message": "Hive \\SystemRoot\\System32\\Config\\SOFTWARE was reorganized with a starting size of 75931648 bytes and an ending size of 75091968 bytes."
}

Event ID 16: The access history in hive HiveName was cleared updating KeysUpdated keys and creating DirtyPages modified pages.

Provider: Microsoft-Windows-Kernel-General
Channel: System
Level: Informational
Opcode: Info

Description

The access history in hive HiveName was cleared updating KeysUpdated keys and creating DirtyPages modified pages.

Message #

The access history in hive %2 was cleared updating %3 keys and creating %4 modified pages.

Fields #

Name	Description	Rules
`HiveNameLength` UInt16
`HiveName` UnicodeString		2 detection rules
`KeysUpdated` UInt32
`DirtyPages` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-General",
    "guid": "{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}",
    "event_source_name": "",
    "event_id": 16,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T05:39:38.4698698+00:00",
    "event_record_id": 6934,
    "correlation": {},
    "execution": {
      "process_id": 1208,
      "thread_id": 4424
    },
    "channel": "System",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HiveNameLength": "41",
    "HiveName": "\\??\\C:\\Windows\\System32\\config\\components",
    "KeysUpdated": "69803",
    "DirtyPages": "8545"
  },
  "message": "The access history in hive \\??\\C:\\Windows\\System32\\config\\components was cleared updating 69803 keys and creating 8545 modified pages."
}

Detection Rules #

View all rules referencing this event →

Sigma # view in coverage

Critical Hive In Suspicious Location Access Bits Cleared source high: Detects events from the Kernel-General ETW indicating that the access bits of a hive with a system like hive name located in the temp directory have been reset. This occurs when an application tries to access a hive and the hive has not be recognized since the last 7 days (by default). Registry hive dumping utilities such as QuarksPwDump were seen emitting this behavior.

Event ID 17: task_017

Provider: Microsoft-Windows-Kernel-General
Channel: Operational
Opcode: Info

Fields #

Name	Description
`ActionName` UnicodeString
`ProcessName` UnicodeString
`AccountName` UnicodeString
`AuthorityName` UnicodeString
`TokenId` HexInt64
`AuthenticationId` HexInt64
`TokenType` UInt32
`ImpersonationLevel` UInt32	Impersonation level (SecurityAnonymous=0, SecurityIdentification=1, SecurityImpersonation=2, SecurityDelegation=3). Known values `%%1831` Anonymous `%%1832` Identification `%%1833` Impersonation `%%1840` Delegation
`TokenFlags` HexInt32
`SidValuesReferenceCount` Int64
`SidValuesCount` UInt32
`SidValues` GUID
`SharedSidValuesReferenceCount` Int64
`SharedSidValuesCount` UInt32
`SharedSidValues` Pointer

Event ID 18: The operating system is starting after soft restart.

Provider: Microsoft-Windows-Kernel-General
Channel: System
Task: SoftBootInfo

Description

The operating system is starting after soft restart.

Message #

The operating system is starting after soft restart.

Fields #

Name	Description
`TransitionStartTime` FILETIME
`CurrentTime` FILETIME
`SoftRestartCount` UInt32
`BugcheckRecovery` Boolean

Event ID 19: BootPerformanceData_V3

Provider: Microsoft-Windows-Kernel-General
Channel: Operational
Task: BootPerformanceData

Fields #

Name	Description
`MmPhase0Start` UInt64
`MmPhase0Stop` UInt64
`Phase1Start` UInt64
`KsrExtensionStart` UInt64
`KsrExtensionStop` UInt64
`StartProcessorsStart` UInt64
`StartProcessorsStop` UInt64
`AutoLoggerInitStart` UInt64
`AutoLoggerInitStop` UInt64
`MmPhase1Start` UInt64
`MmPhase1Stop` UInt64
`HalPhase0StartCycleTime` UInt64
`HalPhase0StopCycleTime` UInt64
`MmMark` UInt64

Event ID 20: The leap second configuration has been updated.

Provider: Microsoft-Windows-Kernel-General
Channel: System
Level: Informational
Task: LeapSecondDataUpdate

Description

The leap second configuration has been updated.

Message #

The leap second configuration has been updated.
Reason: %1
Leap seconds enabled: %2
New leap second count: %3
Old leap second count: %4

Fields #

Name	Description
`UpdateReason` UInt32	Reason.
`EnabledNew` Boolean	Leap seconds enabled.
`CountNew` UInt32	New leap second count.
`CountOld` UInt32	Old leap second count.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-General",
    "guid": "{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}",
    "event_source_name": "",
    "event_id": 20,
    "version": 0,
    "level": 4,
    "task": 6,
    "opcode": 0,
    "keywords": -9223372036854775792,
    "time_created": "2026-05-29T16:32:43.9847457+00:00",
    "event_record_id": 6667,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 8
    },
    "channel": "System",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "UpdateReason": "0",
    "EnabledNew": "true",
    "CountNew": "0",
    "CountOld": "0"
  },
  "message": "The leap second configuration has been updated.\r\nReason: Leap second data initialized from registry during boot\r\nLeap seconds enabled: true\r\nNew leap second count: 0\r\nOld leap second count: 0"
}

Event ID 21: Failed to update leap second data from the registry.

Provider: Microsoft-Windows-Kernel-General
Channel: System
Task: LeapSecondDataParseFailure

Description

Failed to update leap second data from the registry. Reason: FailureResult.

Message #

Failed to update leap second data from the registry. Reason: %1

Fields #

Name	Description
`FailureResult` UInt32

Event ID 22: The time zone bias has changed to NewBias from OldBias.

Provider: Microsoft-Windows-Kernel-General
Channel: System
Level: Informational
Task: TimeZoneBiasChange

Description

The time zone bias has changed to NewBias from OldBias.

Message #

The time zone bias has changed to %1 from %2.

Fields #

Name	Description
`NewBias` Int32
`OldBias` Int32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-General",
    "guid": "{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}",
    "event_source_name": "",
    "event_id": 22,
    "version": 0,
    "level": 4,
    "task": 8,
    "opcode": 0,
    "keywords": -9223372036854775792,
    "time_created": "2026-05-27T21:37:08.8715227+00:00",
    "event_record_id": 1039,
    "correlation": {},
    "execution": {
      "process_id": 7348,
      "thread_id": 9984
    },
    "channel": "System",
    "computer": "WIN11-25H2-X64",
    "security": {
      "user_id": "S-1-5-21-3798294047-1846905762-1150995898-1000"
    }
  },
  "event_data": {
    "NewBias": "0",
    "OldBias": "240"
  },
  "message": "The time zone bias has changed to 0 from 240."
}

Event ID 23: VsmPerformanceData

Provider: Microsoft-Windows-Kernel-General
Channel: Operational
Task: VsmPerformanceData

Fields #

Name	Description
`VsmCleanupTime` UInt64
`Mark0` UInt64
`Mark1` UInt64
`Mark2` UInt64
`Mark3` UInt64
`Mark4` UInt64
`Mark5` UInt64
`Mark6` UInt64
`Mark7` UInt64
`VsmCleanupTimeFrequency` UInt64

Event ID 24: The time zone information was refreshed with exit reason ExitReason.

Provider: Microsoft-Windows-Kernel-General
Channel: System
Level: Informational
Task: TimeZoneInformationRefresh

Description

The time zone information was refreshed with exit reason ExitReason. Current time zone bias is CurrentBias.

Message #

The time zone information was refreshed with exit reason %1. Current time zone bias is %2.

Fields #

Name	Description
`ExitReason` UInt32
`CurrentBias` Int32
`CurrentTimeZoneID` UInt32
`TimeZoneInfoCacheUpdated` UInt8
`FirstRefresh` UInt8

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-General",
    "guid": "{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}",
    "event_source_name": "",
    "event_id": 24,
    "version": 0,
    "level": 4,
    "task": 11,
    "opcode": 0,
    "keywords": -9223372036854775792,
    "time_created": "2026-05-29T23:38:45.9331273+00:00",
    "event_record_id": 6855,
    "correlation": {},
    "execution": {
      "process_id": 5172,
      "thread_id": 5420
    },
    "channel": "System",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "ExitReason": "0",
    "CurrentBias": "0",
    "CurrentTimeZoneID": "0",
    "TimeZoneInfoCacheUpdated": "0",
    "FirstRefresh": "0"
  },
  "message": "The time zone information was refreshed with exit reason 0. Current time zone bias is 0."
}

Event ID 25: The system time was initialized to SystemTime.

Provider: Microsoft-Windows-Kernel-General
Channel: System
Level: Informational
Task: BootSystemTime

Description

The system time was initialized to SystemTime.

Message #

The system time was initialized to %1. 

Loader time: %2
Internal boot flags: %3
HAL RTC error code: %4
RTC time is in UTC: %5
Soft boot: %6
Success: %7
Phase: %8

Fields #

Name	Description
`SystemTime` FILETIME
`LoaderTime` FILETIME
`InternalBootFlags` UInt64
`HalRtcErrorCode` UInt32
`RealTimeIsUniversal` Boolean
`IsSoftBoot` Boolean
`Success` Boolean
`Phase` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-General",
    "guid": "{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}",
    "event_source_name": "",
    "event_id": 25,
    "version": 0,
    "level": 4,
    "task": 12,
    "opcode": 0,
    "keywords": 9223372036854775824,
    "time_created": "2026-04-18 00:24:00.564163+00:00",
    "event_record_id": 5,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 4,
      "thread_id": 8
    },
    "channel": "System",
    "computer": "USERUSE-I0E7KUG",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "SystemTime": "2026-04-18 01:24:00.500000+00:00",
    "LoaderTime": "2026-04-18 01:23:59+00:00",
    "InternalBootFlags": "2",
    "HalRtcErrorCode": "0",
    "RealTimeIsUniversal": "False",
    "IsSoftBoot": "False",
    "Success": "True",
    "Phase": "0"
  },
  "message": "The system time was initialized to ?2026?-?04?-?18T01:24:00.500000000Z. \r\n\r\nLoader time: ?2026?-?04?-?18T01:23:59.000000000Z\r\nInternal boot flags: 0x2\r\nHAL RTC error code: 0x0\r\nRTC time is in UTC: false\r\nSoft boot: false\r\nSuccess: true\r\nPhase: 0"
}

Event ID 26: Token information was queried for TokenIsAppContainer

Provider: Microsoft-Windows-Kernel-General
Channel: Operational

Description

Token information was queried for TokenIsAppContainer.

Fields #

Name	Description
`ProcessName` UnicodeString
`PackageSid` SID

Event ID 26: Token information was queried for TokenIsAppContainer.

Provider: Microsoft-Windows-Kernel-General
Channel: System

Description

Token information was queried for TokenIsAppContainer.

Message #

Token information was queried for TokenIsAppContainer.

Fields #

Name	Description
`ProcessName` UnicodeString
`PackageSid` SID

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID a68ca8b7-004f-d7b6-a698-07e2de0f1f5d

Defined in Microsoft-Windows-System-Events.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3932, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)