Microsoft-Windows-MMCSS

16 events across 1 channel

Event	Title	Channel	Sample
1	Thread priority of.	Operational	N
2	Scheduler woke up for reason Reason.	Operational	N
3	Scheduler thread slept.	Operational	N
5	MMCSS Service started.	Operational	N
6	MMCSS Service stopped.	Operational	N
7	Thread joined MMCSS Task TaskName.	Operational	N
8	Thread left MMCSS	Operational	N
12	TaskIndex TaskIndex yielded for Duration hectons.	Operational	N
13	TaskIndex TaskIndex canceled a registered yield.	Operational	N
14	TaskIndex TaskIndex sets multimedia mode to ThreadTag.	Operational	N
15	TaskIndex TaskIndex deadline Expired.	Operational	N
16	Notify Power Manger to engage turbo mode (TurboEngaged).	Operational	N
17	Thread Buffering Start (ThreadID).	Operational	N
18	Thread Buffering Stop (ThreadID).	Operational	N
19	TaskIndex TaskIndex predeadline Expired.	Operational	N
20	Thread joined MMCSS TaskIndex TaskIndex TaskName1 TaskName1 TaskName2 TaskName2.	Operational	N

Event ID 1: Thread priority of.

Provider: Microsoft-Windows-MMCSS
Channel: Operational
Task: Scheduler_Priority_Change

Description

Thread priority of (ProcessID.ThreadID) in task TaskIndex has changed to Priority.

Message #

Thread priority of (%1.%2) in task %4 has changed to %3.

Fields #

Name	Description
`ProcessID` UInt32
`ThreadID` UInt32
`Priority` UInt8
`TaskIndex` UInt32

Event ID 2: Scheduler woke up for reason Reason.

Provider: Microsoft-Windows-MMCSS
Channel: Operational
Task: Scheduler_Wakeup

Description

Scheduler woke up for reason Reason.

Message #

Scheduler woke up for reason %1.

Fields #

Name	Description
`Reason` UInt32

Event ID 3: Scheduler thread slept.

Provider: Microsoft-Windows-MMCSS
Channel: Operational
Task: Scheduler_Sleep

Description

Scheduler thread slept.

Message #

Scheduler thread slept.

Fields #

Name	Description
`Reason` UInt32
`Duration` UInt32

Event ID 5: MMCSS Service started.

Provider: Microsoft-Windows-MMCSS
Channel: Operational
Task: Service_Start

Description

MMCSS Service started.

Message #

MMCSS Service started.

Event ID 6: MMCSS Service stopped.

Provider: Microsoft-Windows-MMCSS
Channel: Operational
Task: Service_Stop

Description

MMCSS Service stopped.

Message #

MMCSS Service stopped.

Event ID 7: Thread joined MMCSS Task TaskName.

Provider: Microsoft-Windows-MMCSS
Channel: Operational
Task: Thread_Join

Description

Thread joined MMCSS Task TaskName.

Message #

Thread joined MMCSS Task %5

Fields #

Name	Description
`ThreadID` UInt32
`MediumPriority` UInt8
`LowPriority` UInt8
`UberLowPriority` UInt8
`TaskName` UnicodeString
`TaskIndex` UInt32
`Category` UInt8
`Flags` UInt8

Event ID 8: Thread left MMCSS

Provider: Microsoft-Windows-MMCSS
Channel: Operational
Task: Thread_Leave

Description

Thread left MMCSS.

Message #

Thread left MMCSS

Fields #

Name	Description
`ThreadID` UInt32
`OriginalBasePriority` UInt8

Event ID 12: TaskIndex TaskIndex yielded for Duration hectons.

Provider: Microsoft-Windows-MMCSS
Channel: Operational
Task: TaskIndex_Yield

Description

TaskIndex TaskIndex yielded for Duration hectons.

Message #

TaskIndex %1 yielded for %2 hectons

Fields #

Name	Description
`TaskIndex` UInt32
`Duration` UInt32
`PreDuration` UInt32

Event ID 13: TaskIndex TaskIndex canceled a registered yield.

Provider: Microsoft-Windows-MMCSS
Channel: Operational
Task: TaskIndex_YieldCancel

Description

TaskIndex TaskIndex canceled a registered yield.

Message #

TaskIndex %1 canceled a registered yield

Fields #

Name	Description
`TaskIndex` UInt32

Event ID 14: TaskIndex TaskIndex sets multimedia mode to ThreadTag.

Provider: Microsoft-Windows-MMCSS
Channel: Operational
Task: Set_MultimediaMode

Description

TaskIndex TaskIndex sets multimedia mode to ThreadTag.

Message #

TaskIndex %1 sets multimedia mode to %2

Fields #

Name	Description
`TaskIndex` UInt32
`ThreadTag` UInt32

Event ID 15: TaskIndex TaskIndex deadline Expired.

Provider: Microsoft-Windows-MMCSS
Channel: Operational
Task: TaskIndex_DeadlineExpired

Description

TaskIndex TaskIndex deadline Expired.

Message #

TaskIndex %1 deadline Expired

Fields #

Name	Description
`TaskIndex` UInt32

Event ID 16: Notify Power Manger to engage turbo mode (TurboEngaged).

Provider: Microsoft-Windows-MMCSS
Channel: Operational
Task: TurboEngaged

Description

Notify Power Manger to engage turbo mode (TurboEngaged).

Message #

Notify Power Manger to engage turbo mode (%1)

Fields #

Name	Description
`TurboEngaged` UInt32

Event ID 17: Thread Buffering Start (ThreadID).

Provider: Microsoft-Windows-MMCSS
Channel: Operational
Task: ThreadBuffering
Opcode: Start

Description

Thread Buffering Start (ThreadID).

Message #

Thread Buffering Start (%1)

Fields #

Name	Description
`ThreadID` UInt32

Event ID 18: Thread Buffering Stop (ThreadID).

Provider: Microsoft-Windows-MMCSS
Channel: Operational
Task: ThreadBuffering
Opcode: Stop

Description

Thread Buffering Stop (ThreadID).

Message #

Thread Buffering Stop (%1)

Fields #

Name	Description
`ThreadID` UInt32

Event ID 19: TaskIndex TaskIndex predeadline Expired.

Provider: Microsoft-Windows-MMCSS
Channel: Operational
Task: TaskIndex_PreDeadlineExpired

Description

TaskIndex TaskIndex predeadline Expired.

Message #

TaskIndex %1 predeadline Expired

Fields #

Name	Description
`TaskIndex` UInt32

Event ID 20: Thread joined MMCSS TaskIndex TaskIndex TaskName1 TaskName1 TaskName2 TaskName2.

Provider: Microsoft-Windows-MMCSS
Channel: Operational
Task: Thread_SetChars

Description

Thread joined MMCSS TaskIndex TaskIndex TaskName1 TaskName1 TaskName2 TaskName2.

Message #

Thread joined MMCSS TaskIndex %1 TaskName1 %2 TaskName2 %3

Fields #

Name	Description
`TaskIndex` UInt32
`TaskName1` UnicodeString
`TaskName2` UnicodeString

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 36008301-e154-466c-acec-5f4cbd6b4694

Defined in avrt.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Microsoft-Windows-MMCSS

Event ID 1: Thread priority of.

Description

Message #

Fields #

Event ID 2: Scheduler woke up for reason Reason.

Description

Message #

Fields #

Event ID 3: Scheduler thread slept.

Description

Message #

Fields #

Event ID 5: MMCSS Service started.

Description

Message #

Event ID 6: MMCSS Service stopped.

Description

Message #

Event ID 7: Thread joined MMCSS Task TaskName.

Description

Message #

Fields #

Event ID 8: Thread left MMCSS

Description

Message #

Fields #

Event ID 12: TaskIndex TaskIndex yielded for Duration hectons.

Description

Message #

Fields #

Event ID 13: TaskIndex TaskIndex canceled a registered yield.

Description

Message #

Fields #

Event ID 14: TaskIndex TaskIndex sets multimedia mode to ThreadTag.

Description

Message #

Fields #

Event ID 15: TaskIndex TaskIndex deadline Expired.

Description

Message #

Fields #

Event ID 16: Notify Power Manger to engage turbo mode (TurboEngaged).

Description

Message #

Fields #

Event ID 17: Thread Buffering Start (ThreadID).

Description

Message #

Fields #

Event ID 18: Thread Buffering Stop (ThreadID).

Description

Message #

Fields #

Event ID 19: TaskIndex TaskIndex predeadline Expired.

Description

Message #

Fields #

Event ID 20: Thread joined MMCSS TaskIndex TaskIndex TaskName1 TaskName1 TaskName2 TaskName2.

Description

Message #

Fields #

Provenance

Downloads