Microsoft-Windows-Kernel-ShimEngine

Event	Title	Channel	Sample	Rule
1	task_0_V1	Debug	Y	N
2	task_02_V1	Debug	N	N
3	ShimCount shim(s) were applied to driver [DriverName].	Operational	Y	N
4	Flags [Flags] were applied to device [DeviceName] - class [DeviceClass].	Operational	Y	N
5	task_05_V1	Operational	N	N
6	task_06_V1	Operational	N	N
10	task_010_V1	Diagnostic	N	N
11	task_011_V1	Diagnostic	N	N
12	task_012_V1	Diagnostic	N	N
13	task_013_V1	Diagnostic	N	N
14	task_014_V1	Diagnostic	N	N
15	task_015_V1	Diagnostic	N	N
16	task_016_V1	Diagnostic	N	N
17	task_017_V1	Diagnostic	N	N
18	task_018_V1	Diagnostic	N	N
19	task_019_V1	Diagnostic	N	N
20	task_020_V1	Diagnostic	N	N
21	task_021_V1	Diagnostic	N	N
22	task_022_V1	Diagnostic	N	N
23	task_023_V1	Diagnostic	N	N
24	task_024_V1	Diagnostic	N	N

Event ID 1: task_0_V1

Channel: Debug
Level: Error
Opcode: Info

Fields #

Name	Description
`EventId` UInt32
`DebugMessage` AnsiString

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-ShimEngine/Debug",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 1,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 7616
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-ShimEngine",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 00:21:17.260Z",
    "version": 0
  },
  "event_data": {
    "DebugMessage": "KSE: ZwOpenFile failed opening DB file!\n",
    "EventId": 0
  },
  "message": ""
}

Event ID 2: task_02_V1

Channel: Debug
Opcode: Info

Fields #

Name	Description
`EventId` UInt32
`DebugMessage` AnsiString

Event ID 3: ShimCount shim(s) were applied to driver [DriverName].

Channel: Operational
Level: Informational
Opcode: Info

Message #

%3 shim(s) were applied to driver [%1].

Shim(s) source: %2.

Shim GUID(s): %4.

Fields #

Name	Description
`DriverName` UnicodeString
`ShimSource` UInt32	Shim(s) source.
`ShimCount` UInt32
`AppliedGuids` UnicodeString	Shim GUID(s).

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-ShimEngine",
    "guid": "0BF2FB94-7B60-4B4D-9766-E82F658DF540",
    "event_source_name": "",
    "event_id": 3,
    "version": 1,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2023-11-06T06:20:55.625365+00:00",
    "event_record_id": 23,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 8
    },
    "channel": "Microsoft-Windows-Kernel-ShimEngine/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DriverName": "storahci.sys",
    "ShimSource": 0,
    "ShimCount": 1,
    "AppliedGuids": "{434abafd-08fa-4c3d-a88d-d09a88e2ab17}"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 4: Flags [Flags] were applied to device [DeviceName] - class [DeviceClass].

Channel: Operational
Level: Informational
Opcode: Info

Message #

Flags [%4] were applied to device [%1] - class [%2].

Flags source: %3.

Fields #

Name	Description
`DeviceName` UnicodeString
`DeviceClass` UnicodeString
`FlagSource` UInt32	Flags source.
`Flags` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-ShimEngine",
    "guid": "0BF2FB94-7B60-4B4D-9766-E82F658DF540",
    "event_source_name": "",
    "event_id": 4,
    "version": 1,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2023-11-06T06:25:19.963498+00:00",
    "event_record_id": 27,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 224
    },
    "channel": "Microsoft-Windows-Kernel-ShimEngine/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DeviceName": "NDIS:PCI\\VEN_8086&DEV_100F",
    "DeviceClass": "NdisMp",
    "FlagSource": 1,
    "Flags": 1
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 5: task_05_V1

Channel: Operational
Opcode: Info

Fields #

Name	Description
`DriverName` UnicodeString
`DriverBase` Pointer
`DriverSize` UInt32
`DriverTimeStamp` UInt32
`DriverCheckSum` UInt32

Event ID 6: task_06_V1

Channel: Operational
Opcode: Info

Fields #

Name	Description
`DriverObject` Pointer
`DriverBase` Pointer

Event ID 10: task_010_V1

Channel: Diagnostic
Opcode: Info

Fields #

Name	Description
`DriverName` UnicodeString
`DriverBase` Pointer
`DriverSize` UInt32
`DriverTimeStamp` UInt32
`DriverCheckSum` UInt32

Event ID 11: task_011_V1

Channel: Diagnostic
Opcode: Info

Fields #

Name	Description
`DriverObject` Pointer
`DriverBase` Pointer

Event ID 12: task_012_V1

Channel: Diagnostic
Opcode: Info

Fields #

Name	Description
`DriverBase` Pointer
`DriverSize` UInt32
`DriverObject` Pointer
`Pdo` Pointer
`Status` UInt32	NTSTATUS reference
`ServiceName` UnicodeString
`HardwareId` UnicodeString

Event ID 13: task_013_V1

Channel: Diagnostic
Opcode: Info

Fields #

Name	Description
`Address` Pointer
`Caller` Pointer
`Type` UInt32
`Size` Pointer
`Tag` UInt32

Event ID 14: task_014_V1

Channel: Diagnostic
Opcode: Info

Fields #

Name	Description
`Address` Pointer
`Caller` Pointer
`Tag` UInt32

Event ID 15: task_015_V1

Channel: Diagnostic
Opcode: Info

Fields #

Name	Description
`DriverObject` Pointer
`Fdo` Pointer
`Irp` Pointer

Event ID 16: task_016_V1

Channel: Diagnostic
Opcode: Info

Fields #

Name	Description
`DriverObject` Pointer
`Fdo` Pointer
`DeviceType` UInt32
`DeviceCharacteristics` UInt32
`Exclusive` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 17: task_017_V1

Channel: Diagnostic
Opcode: Info

Fields #

Name	Description
`DriverObject` Pointer
`Fdo` Pointer
`Irp` Pointer
`MajorCode` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 18: task_018_V1

Channel: Diagnostic
Opcode: Info

Fields #

Name	Description
`DriverObject` Pointer
`Fdo` Pointer
`Irp` Pointer
`MinorCode` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 19: task_019_V1

Channel: Diagnostic
Opcode: Info

Fields #

Name	Description
`DriverObject` Pointer
`Fdo` Pointer
`Irp` Pointer
`Status` UInt32	NTSTATUS reference

Event ID 20: task_020_V1

Channel: Diagnostic
Opcode: Info

Fields #

Name	Description
`DriverObject` Pointer
`Fdo` Pointer
`Irp` Pointer
`Status` UInt32	NTSTATUS reference

Event ID 21: task_021_V1

Channel: Diagnostic
Opcode: Info

Fields #

Name	Description
`DriverObject` Pointer
`Fdo` Pointer
`Irp` Pointer
`MinorCode` UInt32
`PowerType` UInt32
`PowerState` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 22: task_022_V1

Channel: Diagnostic
Opcode: Info

Fields #

Name	Description
`DriverObject` Pointer
`Fdo` Pointer
`Irp` Pointer
`MinorCode` UInt32
`PowerType` UInt32
`PowerState` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 23: task_023_V1

Channel: Diagnostic
Opcode: Info

Fields #

Name	Description
`DriverObject` Pointer
`Fdo` Pointer
`Irp` Pointer
`MinorCode` UInt32
`PowerState` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 24: task_024_V1

Channel: Diagnostic
Opcode: Info

Fields #

Name	Description
`DriverObject` Pointer
`Fdo` Pointer
`Irp` Pointer
`Status` UInt32	NTSTATUS reference

Provenance

ETW provider GUID 0bf2fb94-7b60-4b4d-9766-e82f658df540

Defined in Microsoft-Windows-System-Events.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3932, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB