Microsoft-Windows-Netshell
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 8001 | NetShell: folder displayed | Performance | N | N |
Event ID 8001: NetShell: folder displayed
#Provenance
ETW provider GUID af2e340c-0743-4f5a-b2d3-2f7225d215de
Defined in netshell.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB