detection.wiki

Microsoft-Windows-MobilityCenter

EventTitleChannelSampleRule
100MobilityCenter_LaunchStartPerformanceNN
101MobilityCenter_LaunchStopPerformanceNN

Event ID 100: MobilityCenter_LaunchStart

#
Channel
Performance
Task
MobilityCenter_Launch
Opcode
Start

Event ID 101: MobilityCenter_LaunchStop

#
Channel
Performance
Task
MobilityCenter_Launch
Opcode
Stop

Provenance

ETW provider GUID 91f42016-0b4e-4a4b-9bbb-825d06cbed35

Defined in Mblctr.exe, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB