Microsoft-Windows-MPS-DRV

Event	Title	Channel	Sample	Rule
1	StartDriverStart	Diagnostic	N	N
2	StartDriverStop	Diagnostic	N	N
3	StopDriverStart	Diagnostic	N	N
4	StopDriverStop	Diagnostic	N	N

Event ID 1: StartDriverStart

Channel: Diagnostic
Task: StartDriver
Opcode: Start

Event ID 2: StartDriverStop

Channel: Diagnostic
Task: StartDriver
Opcode: Stop

Event ID 3: StopDriverStart

Channel: Diagnostic
Task: StopDriver
Opcode: Start

Event ID 4: StopDriverStop

Channel: Diagnostic
Task: StopDriver
Opcode: Stop

Provenance

ETW provider GUID 50bd1bfd-936b-4db3-86be-e25b96c25898

Defined in mpsdrv.sys, the binary that emits these events.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1150, captured 2026-06-02 — Manifest XML pack, 2.0 MB